Best practices for Appwrite authentication in React Native — External API wrapper safe or direct SDK

Hi Appwrite community,

I’m building a React Native app and planning to use Appwrite for authentication. I have some questions about the architecture and security:

Is it safe to create an external API wrapper (e.g., a Next.js backend route) that calls createEmailPasswordSession using the Appwrite SDK, then returns the access and refresh tokens back to the React Native app?

Since React Native doesn’t have browser-like cookie handling, I would need to manually store tokens securely on the device. Is this approach considered secure?

Will the Appwrite server recognize the user properly if I proxy authentication requests through my backend server, or will it treat all requests as coming from the server itself?

Alternatively, is it better to have the React Native app call the Appwrite SDK directly, and if so, what’s the best way to securely manage tokens in this case?

I want to ensure my authentication flow is secure and follows best practices, especially in the context of React Native apps.

Any practical advice or experiences would be greatly appreciated!

Thanks a lot!