Hiding an API Token in a theme component

I guess I managed to write a plugin but I need to put it to github in order to include it in my app.yml. Which naturally exposes the token as well. Is there a way to get around this?