Is it possible to integrate the API in public-facing applications without revealing the security credentials?

This is not facilitated by us at the moment, you will have to implement your own authentication service.