I don’t know much about node, but that looks ok as far as I can see.
One thing you could try is sending the API credentials via HTTP headers, rather than parameters. Sending via parameters is deprecated, and will cause a warning in your admin panel. The header names are Api-Key and Api-Username (note hyphens, not underscores). More info here.