In React, storing sensitive information (like an API token) directly in .env files and then using it in frontend code can indeed lead to exposure, as you've noticed. Even if you reference the token using process.env.RESTUSERTOKEN, it will be accessible in the client-side code if it's bundled with your app by Webpack.

The best approach is to use a backend to handle API requests. Instead of exposing the token in the frontend, create an endpoint in your backend server to make API requests. Your React app can then call this backend endpoint without directly exposing the token.