Q:

What is a token in a TokenCredential in @azure/storage-blob, and how do I acquire one? 

I am using a Storage Account for Blobs. 
I am exposing a SPA web application that acts acts as an online file manager for the blobs in the storage account. 
I am using @azure/storage-blob
I want to be able to circumvent usage of an Azure Function to generate SAS-tokens, and SharedKey credentials are only for server-side.  This leaves only TokenCredential as a means of authorization. 
What I've tried:
I've tried to register my web app in App Registration, and allowed it "user_impersonation" for Storage Accounts.  I then used MSAL to first login the user, and then silently acquire an accesstoken. 
My assumption was that this would work as a token for the TokenCredential, but it does not for me. 
Has anyone tried this themselves? 
Thanks,
Rasmus

A:

By reviewing the @azure/storage-blob SDK, for BlobServiceClient, there is a constructor
  constructor(
    url: string,
    credential?:  StorageSharedKeyCredential | AnonymousCredential | TokenCredential,
    options?:  StoragePipelineOptions
  );

As you are developing a SPA, you may use InteractiveBrowserCredential in @azure/identity
  var interactiveBrowserCredential = new InteractiveBrowserCredential("tenant_id, e4c9ab4e-****-****-****-230ba2a757fb", "client_id,ebb50468-****-****-****-85e7968135c0");
  const blobServiceClient = new BlobServiceClient(
    `https://${account}.blob.core.windows.net`,
    interactiveBrowserCredential
  );

By the way, you need to assign necessary storage role for a use before him accessing storage with AAD token. 