To the file where is calling `npm-donate`. But instead of hard code the API Key, you use some sort of dotenv to hide the API key from the end users.
When users install your package, they won't see your API key.
The code on the endusers machine needs the API key to function, since there is no server on the publishers side involved, right? So you have to give the API key to them in some way, if directly embedded in the code or not.
You are right. I will add a warning and try to figure it out a better way. Thanks!