I want to call a non salesforce API from an LWC UI. I want the request from the browser to the API to be secured (authenticated at the very least and ideally authorised).
From what I've read, I believe I should create an endpoint with SalesForce Apex to create a proxy onto my API. Secure the Apex proxy call with an API key (for example) or OAuth client credentials flow.
The I can secure the browser call to the Apex endpoint by ensuring the LWC code can pass the user/agents bearer token.
Can I check the validity of the bearer token passed by the browser in Apex code? Or is there a different mechanism?
Instead is there a best practice approach I can use secure the request? Best practice docs seem very light on the ground!