You can have your cake and eat it too. You can have an API that handles all the important stuff (authn, authz, database access, 3P services...). Your mobile/d

You can have your cake and eat it too. You can have an API that handles all the important stuff (authn, authz, database access, 3P services...). Your mobile/desktop/CLI/smart toaster apps can speak directly to that. For the web, you can additionally have a web server that just serves HTML/CSS/JS, pre-rendered or not. This server can act as just another client "app", i.e, access the API on behalf of users. No special treatment, no business logic, just a dumb HTML shooter. And definitely no secret tokens.