Azure KeyVault and Authentication on client side

Question

I'd like to know more about the following situation:

A web application is launched by a client in the browser. Secrets are retrieved using Javascript from an Azure Key Vault in the web application. The connection to another Azure service is then made using these secrets in order to retrieve data.

The only thing that Azure Key Vault safeguards is the transmission of secrets. After retrieval, could the client view or plainly reverse engineer the secrets on the web browser?

=> Is this accurate and still secure?

The client can log in to the other service using these secrets, according to Question 2.

=> Is it conceivable that just the web app is authorised to utilise the secrets for authentication? The user shouldn't be able to utilise the secrets in another programme even if he knows what they are.