title: Making Graph Calls Client Side
body: <p>I am building a Teams application that will use Microsoft Graph to add and remove rows from a SharePoint list. I have taken a look at a number of examples provided in the Teams-Toolkit extension in VSCode including <a href="https://github.com/OfficeDev/TeamsFx-Samples/tree/v2/graph-toolkit-contact-exporter" rel="nofollow noreferrer">Graph Toolkit Contacts Exporter</a> and <a href="https://github.com/OfficeDev/TeamsFx-Samples/tree/v2/hello-world-tab-with-backend" rel="nofollow noreferrer">Hello World Tab With Backend</a>. The examples have left me confused about weather I can safely make Graph calls directly from the client side, since in both examples have done so?</p>
  <ul>
  <li>Is it safe to make graph calls from the client side when using the TeamsSDK?</li>
  <li>Does this expose a token in an unsafe browser?</li>
  <li>Should I instead be making graph calls server side? e.g. using the on behalf of flow or is that only relevant if you are interfacing with API's where you have a single application level api key?</li>
  </ul>