The API is the contract
An app should not expose database credentials or directly bypass business validation. Approved backend endpoints define what information can be requested, updated and audited.
Design for imperfect networks
Requests can time out, responses may arrive twice and users may retry. Plan clear error messages, safe retries, API versioning and idempotency for sensitive operations.
Protect every boundary
Use HTTPS, appropriate authentication, short-lived tokens where suitable, server-side permissions and careful logging. Test negative cases, not only the happy path.
Ownership and maintenance
Clarify who maintains API documentation, credentials, environments and production monitoring. The app and backend need coordinated release procedures.