Javascript Calling a Rest API with App Name and Ap

I am sure this Question has been asked a lot of time.

But wanted re-confirm my doubt and get some tips.

i was planning to play around with buddy.com back end as a service. and i saw that most of their REST API requires App Name and Password to be embedded if you are using JavaScript. They don't have any documentation for javascript, yet. But was wondering if i have to start using it right now from Javascript using normal html or HTML5 web app. how do i use it.

i don't want to pass App Password in the clear text as anybody could do a view source of the browser or could run fiddler to see what's being called. I know once would say, hey why don't you use the Token system valid for a particular time.

But i am the consumer over here, How can I protect the password being see in the view source of the browser since i would be calling the API through the java script on the web page/ app.

Typical example of buddy.com API

http://webservice.buddyplatform.com/Service/v1/BuddyService.ashx?Pictures_ProfilePhoto_Add&BuddyApplicationName=&BuddyApplicationPassword=&UserToken=&bytesFullPhotoData=&ApplicationTag=&RESERVED=

Any tips would be greatly appreciated. Thanks

JavaScript running by the client can always be modified with GreaseMonkey. ALL VARIABLES can be read with a JavaScript debugger like Firebug. ALL REQUESTS can be intercepted and modified with tamperdata.

The result is that you can never trust JavaScript because its client side code. In order to keep a secret from an attacker, you need to keep it from JavaScript. You can do this with an intermediary API, that knows the secrets and performs requests on the client's behalf. This API needs to enforce authentication, or who has access to a given resource.