I posted this question on DBA, but it got closed and was never reopened even after I rewrote the whole thing to be more specific. I think its more appropriate for programmers anyway :)
The URL to the document attachment included in the JSON response from Server B includes access credentials (username:password). Server A responds to the client-side request by returning those JSON objects.
The client now has this information:
Currently all data contained within Server B resides in one database instance. If the client has access to the username:password to the CouchDB then all data could be queried with those access credentials. Like so,
CouchDB on Cloudant
What I am looking for
Essentially my solution would come if I can provide a link to a CouchDB document attachment without giving the username/password.
What I did
I had to enable cURL for PHP on Server A.
sudo apt-get install curl libcurl3 libcurl3-dev php5-curl sudo /etc/init.d/apache2 restart
Got a bit of code from David Walsh's blog.
I can now serve out the files to the client without revealing username or password for CouchDB on Server B.