Is there a way to store a hardcoded user name /password in an HipChat addon done in atlas-connect and node js, such that it wont be visible in the front end BUT would be used by the front end JS to make ajax calls?
When something is used by frontend, it is fully exposed, so the answer is definitely no. You have to either use that password from the server side (after properly authenticating the call from the hipchat) or use some kind of token that is not dangerous to expose.