Access Record data from an html page via API call

I have had a hard time getting accustomed to working with API calls from outside of Quick Base and since I have limited experience with XML. Finally after struggling quite a bit I have come up with a (seemingly) decent method for getting/accessing record data from an API call in an HTML page.

I will post the code below and please provide any feedback for this method, I am still early using Quick base API calls. This method uses the option to return the record data as a 2-dimensional array that can be accessed with "qdb_data" where the "x" is the index selector. You can easily check the number of returned records by looking at "qdb_data.length"

<head>
<script lang="javascript" src="yourdomain/db/
yourtable?a=API_GenResultsTable&query={'field id'.operator.matchvalue}&jsa=1&apptoken=[yourtoken]">
</script>
<script>
function displayData(){
alert(qdb_data);
}</script>
</head>

Curious about the security of having the API info and app token within the client-side code. Obviously a QB code page is fairly secure compared to a remote code page but still curious about it. 

Thanks everyone.