What method to use to call a REST API?

In general it is always better to get the information straight from the source…. but you have to think about security. Using the REST API client from a different domain will require disable CORS protections for that domain. The amount of risk related to that depends upon how tied are the domains (do they have same admins, same kind of private data and such). This should not be done lightly and requires thinking as it opens a new attack vector against the “main” site.

OTOH if the data can not be cached, it is just “stupid” to do two requests instead of one.

The right implementation is probably to “overload” the API end points on the “main” server with a different domain that do not share cookies, which will eliminate the need for CORS protection. (this obviously assumes that user authentication is not required for what you are trying to do with the API)

tech