Unless I misunderstood you want to give the user and password to a client in the web to access the database directly?
Yup, I think it’s a slight misunderstanding in that the user and password are meant to be given to an application, not to a client. I.e.: think a Phoenix app which you would typically provide a DATABASE_URL to, not a React client that might typically talk to an API endpoint.
Thanks for flagging up as I should make that clear. You definitely shouldn’t expose the db user credentials publicly 
Also, the cURL request can be done from a client in the internet?
IntegrateDB is an application you would deploy on your infrastructure (server / cloud / cluster) fairly close to / alongside your database. So you can lock down access as you prefer – network firewall, RBAC, reverse proxy, etc.
The API is also envisaged as something more for an operator to talk to (a CLI is on the roadmap) or to use as part of an provisioning workflow. It would be unusual for your application to talk to it.
Hope that makes sense
