How to hide javascript API access data?

Question

How do I hide this information that I pass as a parameter to the token request? the way anyone can see and cannot

var chaveToken = {
                "grant_type": "password",
                "username": "[email protected]",
                "password": "xxxxxxxxxx@121111"
            };       
    var token;

            $.ajax({
                url: 'http:/xxxxxx.com.br/token',
                async: false,
                contentType: 'application/x-www-form-urlencoded',
                type: 'POST',
                data: chaveToken,
                success: function (data) {
                    token = data.access_token);                        
                }
            });            


        $.ajax({
            url: 'http://xxxxxx.com.br/obterlistasreembolso',
            async: false,
            beforeSend: function (xhr) {
                xhr.setRequestHeader('Authorization', 'bearer ' + Token);
            },
            success: function (data) {
               bla bla bla
            }                
        });

Answer 1

Since this is client-side, you can’t hide it. What you have to do is get the token through the server (server-side) using some language like PHP, ASP, ASP.NET, Java/JSP, Javascript (if it is by Node.js) and then you pass to the page only the token already obtained.

If not even the token can be seen by the user, then you must modify your application to act as a proxy for the API, where the user calls "actions" in your application and then it consumes the API of the service you are using in JS.

Just note the fact that the token can be generated based on the IP of the request, so if you generate the token by the server-side, the token will be generated for the IP of your server and if you choose the first alternative to pass only the token to the page, when the user requests with the token, the request will be by his IP (since it is client-side) and so the API can inform that the token is not valid (this you find out by the API documentation or even by performing tests)in which case you will be required to do the second alternative, turning your application into a proxy for the API by the server-side.

Answer 2

As @bfavaretto commented, there is no way to hide these credentials using the API in javascript. For this, use the server-side version of it.