Create SAS Signatures for Relay endpoints. Code for blog post http://www.codit.eu/blog/2014/12/securing-azure-service-bus-relay-endpoints-with-sharedaccesssignatures/

app.config.xml

<system.serviceModel>
  <behaviors>
    <endpointBehaviors>
      <behavior name="sbbehavior">
        <transportClientEndpointBehavior>
          <tokenProvider>
            <sharedAccessSignature keyName="SendAccessKey" key="xxx=" />
          </tokenProvider>
        </transportClientEndpointBehavior>
      </behavior>
    </endpointBehaviors>
  </behaviors>
  <bindings>
    <basicHttpRelayBinding>
      <binding name="sbBinding" isDynamic="false" />
    </basicHttpRelayBinding>
  </bindings>
  <client>
    <endpoint address="https://xxx.servicebus.windows.net/us/myservice" binding="basicHttpRelayBinding" bindingConfiguration="sbBinding" behaviorConfiguration="sbbehavior" contract="wcfService.IService1" name="sbendpoint" />
  </client>
</system.serviceModel>

relay-sas.cs

NamespaceManager nsManager = NamespaceManager.CreateFromConnectionString("Endpoint=sb://xxx.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=xxx=");
var relayDescription = new RelayDescription("us/myservice", RelayType.Http)
{
    RequiresClientAuthorization = true,
    RequiresTransportSecurity = true
};

var sendKey = SharedAccessAuthorizationRule.GenerateRandomKey();
var sendKeyName = "SendAccessKey";
var listenKey = SharedAccessAuthorizationRule.GenerateRandomKey();
var listenKeyName = "ListenAccessKey";

relayDescription.Authorization.Add(new SharedAccessAuthorizationRule(listenKeyName, listenKey,
        new List<AccessRights> { AccessRights.Listen }));
relayDescription.Authorization.Add(new SharedAccessAuthorizationRule(sendKeyName, sendKey,
        new List<AccessRights> { AccessRights.Send }));

try
{
    var relay = await nsManager.CreateRelayAsync(relayDescription);
}
catch (MessagingException ex)
{
    Console.WriteLine(ex);
}
Console.WriteLine("Listen access rule created with key '{0}' and name {2} on entity '{1}'", listenKey, relayDescription.Path, listenKeyName);
Console.WriteLine("Send access rule created with key '{0}' and name {2} on entity '{1}'", sendKey, relayDescription.Path, sendKeyName);

web.config.xml

<system.serviceModel>
  <services>
    <service name="WcfService1.Service1">
      <endpoint address="https://xxx.servicebus.windows.net/us/myservice" behaviorConfiguration="sbbehavior" binding="basicHttpRelayBinding" bindingConfiguration="sbBinding" name="sbendpoint" contract="WcfService1.IService1" />
    </service>
  </services>
  <bindings>
    <basicHttpRelayBinding>
      <binding name="sbBinding" isDynamic="false" />
    </basicHttpRelayBinding>
  </bindings>
  <behaviors>
    <endpointBehaviors>
      <behavior name="sbbehavior">
        <transportClientEndpointBehavior>
          <tokenProvider>
            <sharedAccessSignature keyName="ListenAccessKey" key="xxx=" />
          </tokenProvider>
        </transportClientEndpointBehavior>
      </behavior>
    </endpointBehaviors>
  </behaviors>
</system.serviceModel>