Is there a way to hide URL and Authentication parameters securely in client side ?
How to restrict the user to not to see this API call details in browser network logs ?
A clever user can see all network activity in their browser's console. There's no way to circumvent this.
And what is the best authentication mechanism for this type of integration ?
You can use whatever method you prefer. If you need to hide authentication information, use server-side code instead.
Will the callout that we do from the client-side will it count for concurrent-Long running transaction - 10 if it exceeds more than 5 secs ?
Client-side will not, but server-side would.
Based on these questions, you might want to consider what you're trying to do. You may want to rethink your approach to logging in and/or using this API. I can't say much more without knowing more, but you must assume that the user can totally control everything on their computer and see all network activity. There's simply no way around it.