You should pass a private key in the same way you pass public key, service template and service id:
var data = {
service_id: 'YOUR_SERVICE_ID',
template_id: 'YOUR_TEMPLATE_ID',
user_id: 'YOUR_PUBLIC_KEY',
accessToken: 'YOUR_ACCESS_TOKEN',
template_params: {
'username': 'James',
'g-recaptcha-response': '03AHJ_ASjnLA214KSNKFJAK12sfKASfehbmfd...'
}
};
Documentation: https://www.emailjs.com/docs/rest-api/send/
Here's an article I wrote explaining how to setup sensitive EmailJS data in Vite+React app deployed on Vercel.