Can Azure speech subscriptionKey stored in client

Quill Zhou 25

I am using https://learn.microsoft.com/en-us/azure/ai-services/speech-service/how-to-recognize-speech?pivots=programming-language-swift to implement speech-to-text. I found that the example demo puts YourSubscriptionKey in the client code; is this safe and reasonable?

dupammi 8,465 Reputation points Microsoft Vendor

2024-08-26T07:13:44.9566667+00:00

Hi @Quill Zhou

Storing the Azure Speech subscription key directly in the client code, as shown in the example, is not a safe practice. This is because client-side code can be easily decompiled, exposing sensitive information like the subscription key to anyone with access to the app's code. If the key is compromised, unauthorized users could misuse your Azure resources, potentially leading to increased costs and security vulnerabilities.

To ensure security, store the subscription key in environment variables or use a secure storage service like iOS Keychain for mobile apps. Instead of embedding the key in the client, set up a backend service to securely manage and use the subscription key, with the client app communicating with this backend for Azure Speech services. For added protection, consider storing the subscription key in Azure Key Vault and retrieving it securely within your backend service.

By following these practices, you can ensure that your subscription key is protected, reducing the risk of unauthorized access to your Azure resources.

Your answer