XML RPC API - Keeping Auth Token private in a public form?

XML RPC API - Keeping Auth Token private in a public form?

We have a public form that we wish to add records into a creator application (inlcuding is't subform).

We are able to successfully submit our form data into Creator using the XML RPC API, with the data structure as per the support doc examples - 
https://www.zoho.com/creator/help/api/xml-rpc-api/xml-rpc-api-add-records.html#Sample_Request

My question is how do you keep the Auth Token private? Anyone who inspects the source code of the form will be able to view the auth token and username.

Many thanks