How to secure the JavaScript API Access Token?

Restrict Access with CORS

Make your web server return the access tokens on an ajax request from you javascript with CORS setup. Token can be captured with this method visiting your app.

Provide Tokens to Authorized Users

You can also add authentication on your webserver to provide limited access to the users you allow. Token can be captured with this method but only by authorized users.

Proxy Requests

The only way to completely protect that token is to proxy the requests through your server. Token cannot be captured with this method. Note that this may be against terms of service.

Javascript API tokens (and all client tokens, in fact) are always visible to the client (unless using them only server-side, as in node). There is no way around that. As you mentioned, the only way to truly secure an API key and keep it private is to store it in the server, then request the server to make the request on the client's behalf.