You should be able to create an auth token with those permisions and use it the way I was doing it, you can also have a proxy server that makes an authorized server side request, and then returns the JSON to the unauthenticated browser - to prevent leaking the token