how to access secured rest service from a html page?

[ShreyesShiv1]

I am developing a javascript app which needs to query an arcgis rest service via token. On the front end(client side) how do i hide the credentials so that it is not exposed? 

Do i store the credentials in a config file on the webserver? If yes, how will the app refer the config file to send the request to arcgis server ?

[alex_mapintel]

Hi @ShreyesShiv1 ,

If you are using AGOL then it depends on the service you need to use. You will need to use OAuth 2.0 with an ArcGIS Identity to access items in your ArcGIS Online organization instead of using an API Key. The limitations of the API Key are shown here. 

This means your application will require a user to authenticate to AGOL to access the secure content. After authentication, you use the token within the application, not the credentials.

I've implemented the above ArcGIS Identity before and it works well however, the users always had to authenticate and input their credentials. Maybe there is a way around this but I'm not sure.