So, I was making a small login app where the user registers, then an verification token gets sent to the email he registered with to verify that he is the owner of that email.

Everything worked fine locally, after I uploaded my repo to GitHub, my MailGun account was deactivated due to "exposed credentials".

MailGun.js requires your MG domain and the private_key(I think?) to send an email (of course and the user's email) . That's what I used and it worked fine before.

If I'm going to upload this small app, what should I use to protect my credentials and send those verification mails? I used to public key which didn't work, and both private_key and HTTP webhook signing key work fine, but I want to know more about this and how to secure it.

Thanks!

Oh Code:

const mailgun = require('mailgun-js');

const sendVerificationMail = function(email, email_Token){
  const domain = DOMAIN_HERE;

  const mg = mailgun({
    apiKey: API_KEY,
    domain,
  })
  
  const data = {
    from: EMAIL,
    to: email,
    subject: 'Email Confirmation',
    text: `Click on the link,: http://localhost:3000/email/validate?access=${email_Token}`,
    html: `<p>click the link: http://localhost:3000/email/validate?access=${email_Token}</p>`
  };
  
  mg.messages().send(data, function(err, res) {
    if(err) console.log(err);
    console.log(res)
  })
}

module.exports = sendVerificationMail;