[negge]

I know all about AJAX restrictions, that's why I'm telling him to do the API calls server-side, then the frontend can request it indirectly via AJAX. Obviously CORS or some other solution would be ideal if you need a JS-only solution.