How Embedding Power BI report in custom application is secured?

Hello 

I am embedding Power BI report in web application using Power BI rest Apis

Refedrred this link :

https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-integrate-report/

Getting a access token from auth2 grant flow seems secure as it had been implemented on server side using C# code.

But when report needs to be embed in iframe i had to fetch reportid , embedurl and accesstoken on javascript side while performing postMessage() on iframe. 

If it needs to be done on client side , How is it secure to embed report this way ?

Please explain.

Another thing i need to ask is regarding Power BI - Javascript APis.

This way of embedding the same way that reportid , accesstoken and embedurl needs to be configure in configration settings

Please refer documentation 

https://github.com/Microsoft/PowerBI-JavaScript/wiki/Embed-Configuration-Details

Then how is it secure if it is on client side.

Thanks in advance