I'm building a prototype app with Cognitive services called from a web browser (this is the most appropriate option for my use case for speech-to-text with continuous recognition), but I won't be able to use this solution in production because anyone can steal our API key. The API key can then be used by anyone to call the services for free (and have it paid by us, potentially generating millions of dollars of billing if done with a malicious intent).

This is not acceptable and there should be a more secure authentication option. For example, something similar to SAS tokens for Azure Blob Storage could be used:
- My web server generates a SAS token from a secret key it knows and that is known to Cognitive services too.
The SAS token has a limited scope: services and features it is allowed to use, how many calls it is allowed to do in total, and expiration datetime.
- After exceeding the allowed number of calls or after the timeout, the web browser must call my authentication service to retrieve a new SAS token
- When calling Cognitive services, the web browser provides the SAS token instead of the API key