A very safe yet flexible way to do this is to expose the URL inside a <script>
block in a view. That way, you are not exposing application configuration (which access you will have to protect very well) but instead just explicitly expose a single secure value.
It also has the added benefit that you do not need to make a request to an endpoint (which address you actually also need to know in your script) but have the value instantly there when you need it.
To do that, you can simply render a <script>
tag that defines the value globally. For example, you could have the following in your layout:
<script>
window._signalRAddress = @Json.Serialize(ViewData["SignalRAddress"]);
</script>
<script src="~/your-custom-script.js"></script>
And then you just use window._signalRAddress
inside of your script.