0

I'm currently working on a project and trying to determine the best approach for doing API callouts. I've come across two different methods: using the Fetch API (particularly in LWC) and the traditional Apex REST API approach.

Could someone clarify the scenarios in which each method should be used? Specifically, I'm interested in understanding:

  1. When is it more appropriate to use the Fetch API and do callout directly from LWC?
  2. In what situations would the traditional Apex REST API approach be the better choice?
  3. Are there performance, security, or complexity considerations that should guide the decision between these two methods?

I have seen a lot of content explaining Fetch API but none discussing the above points. Any insights or examples would be greatly appreciated!

3
  • 1
    Doing anything with some secondary system directly from the browser is inherently less secure - someone with basic JavaScript knowledge could mess with the payload sent to exploit that API in an already authenticated context. By performing the integration server side (from a flow or some Apex) you keep the external system' API usage " hidden" and inherently more secure. If the API payloads are such that you can handle them with Apex and DataWeave, IMHO you should take that approach, despite the increased daily API calls onto your org, simply from the security perspective.
    – Phil W
    Commented Aug 11 at 14:02
  • @PhilW Calls from LWC to Apex do not count against API usage, only actual API calls.
    – sfdcfox
    Commented Aug 11 at 15:59
  • Oh, yes, indeed. Sorry, I did muddy the water on that point.
    – Phil W
    Commented Aug 11 at 16:02

1 Answer 1

0

Generally speaking, you should look into solving business requirements with features already available in the platform, such as the option to generate flow actions based off API specification files. If built-in features like this do not solve your use case, then you go to code (which I believe is your main point here).

When dealing with code in the platform the principle is the same: the simpler things are, the better. If your requirement is too close or doesn't fit the governor limits boundaries, for example, then you are better off looking for alternatives, such as having the client handle some of the processing. From the top of my head I can think of the classic issue of having Salesforce upload files to an external system. Apex isn't meant for that, so the alternative is to use another system or have the front end (user's browser) do that. There are some usage considerations, like Phil W mentioned in his comment, and that spills on the security and complexity aspect, of course.


But to answer more directly:

  1. When is it more appropriate to use the Fetch API and do callout directly from LWC?

It is more appropriate to do callouts directly from the front end when the back end is limited and you don't have a workaround for the limitations you found (see the "file upload" example in the first part of this answer).

  1. In what situations would the traditional Apex REST API approach be the better choice?

Whenever possible. This is the preferred approach (that is: to leverage the existing platform structure and resources - including the security of it).

  1. Are there performance, security, or complexity considerations that should guide the decision between these two methods?

If you can process things entirely within the platform's boundaries (in the back end), that is better because you are shifting most of the security and processing to Salesforce. Otherwise, you will need to consider carefully how you are going to handle the data you are working with. Take once again the "file upload example": if you do uploads through the UI instead of the back end, then you have to worry about usability (you can't let users close the browser until the file is uploaded completely) and security (need to make sure only authenticated users from Salesforce can upload files through your file API - see the "presigned urls" from the AWS S3 documentation for an example of how to handle this kind of situation in a more secure fashion).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .