In this case it’s not a third party API but your own products API. Also while you can use the same endpoints, authentication and authorization don’t have to be the same. You could use your standard basic auth (or other) for your regular API use case and then use cookie based auth or JWTs (or whatever other auth you want) for the SPA. Again this isn’t for third party APIs but for companies creating a web app for their own apps so you can have flexibility.
Comments
In this case it’s not a third party API but your own products API. Also while you can use the same endpoints, authentication and authorization don’t have to be the same. You could use your standard basic auth (or other) for your regular API use case and then use cookie based auth or JWTs (or whatever other auth you want) for the SPA. Again this isn’t for third party APIs but for companies creating a web app for their own apps so you can have flexibility.