This is more of a design confusion. LWC documentation recommends making external API callout from LWC (client-side) before Apex. However, I have below doubts -
Is it safe to make 3rd-party API callout from the frontend, when accessToken is involved?
Also, we may need to hardcode URLS in the code. Are there best practices for the same?
In case the integration requires sending certificates (for 2 way), is it recommended?
Also, what IPs needs to be whitelisted at endpoint end, for client-side calls?
Server-side calls introduce an extra middleman, but apart from performance, is there any other advantage of make callout from client-side?