Here's one solution that might work:
1. Create a special non-SSO user that has the same permissions as an anonymous user.
2. In your JavaScript widget, make a call to the API login method with this users credentials (they'll have to be hard coded in your JavaScript) to get an authentication token for that user:
3. Use the authentication token in subsequent API calls.
I've just tried doing this manually on a browser that was logged in, and it seems to work (i.e. it treats you as the special user, not your normal user, even if you were previously logged in).
If you do use this approach, be aware that the username and password for your anonymous user will be visible to anyone visiting the site, and any metrics from the API calls will be associated with that single user.
