Congrats on the launch! There’s a strong shift of devtools from the backend to the frontend, and services are often jumping through hoops to 1) remain secure, and 2) allow client-only integration.

For example, Stripe offers a client-only integration with similar limitations - the product catalog must be defined within the stripe dashboard. https://stripe.com/docs/payments/checkout/client

At https://clerk.dev (disc: founder), we do all of sign up, sign in, and user profile management from just the client. We’re able to keep it secure because we also do session/cookie management, so can tell who is signed in.

Emailjs has an interesting concept here. It’s definitely on-trend, though I personally wouldn’t like users being able to trigger emails to other users, which seems possible today (correct me if I’m wrong?)

Have you considered an option to require a signed JWT with requests, which could contain the user’s email address? That would make it so users can only trigger spam to themselves (except in cases of xss), but retain a mostly client-only experience. (Generating the jwt requires a backend, but developers may already have one available if they’re using another service like Hasura that follows a similar pattern.)