title: Azure Event Hubs: How to grant SAS tokens to Javascript publishers (running in browser)?
body: <p>I am building a website analytics solution based on Azure Event Hubs. I have Javascript code embedded in each web page that publishes events directly to an Event Hub via the <a href="https://msdn.microsoft.com/en-us/library/azure/dn790674.aspx" rel="nofollow">Azure Event Hubs REST API</a>.</p>
  
  <p>The REST API requires that each call be authenticated via a SAS token. My questions is - Do I have to code up a server side endpoint that will provide my publishers with temporary tokens before they can start publishing?</p>
  
  <p>Are there alternative approaches?</p>
  
  <ol>
  <li>Does the REST API provide this "authenticate" end point out of the box? (couldn't find it <a href="https://msdn.microsoft.com/en-us/library/azure/dn790674.aspx" rel="nofollow">here</a>)</li>
  <li>Or, how <strong>terrible, security wise</strong> would it be to have a token hard coded into the client-side code?</li>
  <li>Or, <strong>technically feasible but security-wise much worse than option 2</strong>, Hard-code the Event Hub's Shared Access Key in the client-side code and use something like the (unofficial) <a href="https://github.com/ddobric/ServiceBusJavaScriptSdk/wiki/What-is-Azure-Service-Bus-JavaScript-SDK%3F" rel="nofollow">Azure ServiceBus JavaScript SDK</a> to <a href="http://developers.de/blogs/damir_dobric/archive/2015/01/26/eventhubs-support-for-azure-servicebus-javascript-sdk.aspx" rel="nofollow">generate</a> the SAS token on the fly?</li>
  </ol>