Avoiding use of longterm credentials in web clients

[ModalityZ]

The example in this repo, the KVSW test page, has a form field for SessionToken but there is no guidance about how to create and renew such a short-lived authentication for web clients. By comparison, IoT Core offers an API for including a Cognito Identity Pool ID, which seems to be a method that a server-based component could use with longterm credentials to generate a short-term credential that it sends to its web clients.

Can someone point me to a technique for creating and renewing short-term credentials for web-based clients that does not expose longterm credentials?

A very specific instance of what I'm looking for is a way to call the KinesisVideo client constructor without revealing long-term credentials. I cannot find any examples using either the browser-side IdentityPool technique nor the server-side request signer technique.