The credentials can be generated dynamically from any server side language like php, python or ruby and sent to the js. Once the call is done or after a certain time these credential can be deleted using server side APIs too.

Edit:

Creating an Endpoint - http://plivo.com/docs/api/endpoint/#create

Deleting an Endpoint - http://plivo.com/docs/api/endpoint/#delete