CODEWITHSUNDEEP
azurespeech-to-textazure-cognitive-services
Chris
Chris

Reputation: 4396

Client billing/client usage for microsoft cognitive services speech to text?

I'm working on a website that is supposed to offer users to make use of azures cognitive services api. They can play audio or use their microphone to transform speech into text.

I'm currently using azures js sdk and technically it's working fine. However, I noticed a big shortcoming with this approach. The sdk connects through a websocket with the azure server, which exposes the subscription key to the client. So every member could theoretically read it out and sell it or alike. Furthermore, if the client connects directly with azure, I have no secure way of preventing clients abusing the service. I need a way to measure roughly how much time a customer uses the service to take into account individual billing.

I could not find anything about that in the official documentation. So what are my options?

  1. Should I redirect the clients' audio input to my own server, do some quantitative analysis, and then forward the input from a server side connection to azure? I fear with many concurrent customers, it might get laggy or connections might get dropped...
  2. Is there any way to attach at least client ids or alike to azure websocket connection that I can read out somehow later?

Do you have any advice for me?

Upvotes: 2

Views: 451

Answers (1)

Nicolas R
Nicolas R

Reputation: 14619

Given your additional comment, I would suggest that you switch your implementation from using subscription key to using authentication tokens.

That would:

  • generate a unique token for each client, based on 1 global subscription key
  • not expose your subscription key to your clients
  • restrict the use of the API, as the token is only valid for 10 minutes

Each access token is valid for 10 minutes. You can get a new token at any time, however, to minimize network traffic and latency, we recommend using the same token for nine minutes.

See documentation here for global implementation. In a nutshell, you need to implement this token generation in your backend, and serve the page to your client with this token instead of the key.

Side note 1: be careful about the maximum number of concurrent requests (100 - see here).

Note 2: that will not help you bill clients given their usage as you have just 1 key and there is no way to identify distinct usages in it

Upvotes: 2

Related Questions