Set the API URL in environment variables, use fetch or axios to call REST APIs, centralize all API calls in one folder, attach the JWT with an axios interceptor for protected endpoints, handle loading and errors consistently, and configure CORS on the backend.

Either works. axios is popular for its interceptors (useful for auth and error handling), automatic JSON parsing, and cleaner error handling. fetch is built into the browser but needs more manual setup. Choose based on your needs.

So the API surface is easy to find, change, and mock in tests. Scattering fetch calls across components makes the API hard to manage and mocks hard to write. A central api folder keeps it organized.