Is it considered acceptable/safe to use an Azure AD access token in the browser for Cognitive Services when /issueToken is unavailable?

Hi Brett Jewell

Did you get any chance to review the above response. Thank you!

Hi, thanks for the response. Could you clarify option 1 — specifically the part about “exchanging the token for a short-lived Speech service token”? I haven’t seen any documentation or examples showing that this kind of token exchange is supported for Speech.

My understanding is that there isn’t a way to obtain a short-lived client-safe token from the browser’s Azure AD token. And since you confirmed that using the Azure AD token directly isn’t recommended, it seems like option 2 is the path I’ll need to take.

Hi Brett Jewell

Azure Speech doesn’t currently support a direct token exchange mechanism where you take an Azure AD token and convert it into a short-lived Speech-specific token. The /issueToken endpoint is the only supported way to obtain a client-safe token for browser use, and that endpoint itself requires an API key.

So, to clarify:

Option 1 (Token Exchange)

• This is not available for Speech. There’s no documented flow to exchange an Azure AD token for a Speech service token.
• The Speech SDK expects either:
  • An API key, or
  • A short-lived token obtained from /issueToken (which itself requires an API key).

Option 2 (Recommended Approach)

• Implement a server-side token broker:
  1. Your backend uses the Speech resource API key to call /issueToken.
  2. It returns the short-lived token (valid for ~10 minutes) to the browser.
  3. The browser uses this token with the Speech SDK for secure calls.

This pattern ensures:

• API keys stay on the server.
• The browser only handles short-lived tokens, reducing exposure risk.

Thanks for confirming. To come full circle: /issueToken is disabled when ‘All networks access’ isn’t enabled, which is the case for my setup. So instead, I’ll need to use the Speech SDK on the backend and forward the responses to the client.