Safely expose credentials to JavaScript client?

Hi David, it sounds like you have a good handle on this already. In order to make an API call, the client (in this case, the browser) needs the access token. Fundamentally though, client-side apps, (such as in a browser) can't keep secrets. 

That means that the access token would be exposed to the users, compromising your account. Unfortunately, there isn't a good way to do this without proxying the requests through your server. (And just to be clear, this is only a problem in the case where you only want to connect to your own account for all users. In the normal case, where users only connect to their own accounts, this is fine since they'd only have their own access tokens anyway.)