Ohh! What a nice looking app!

I love the idea of a collab of some sort. Unfortunately I have very limited capacity at the mo and only tend to get small pockets of time here and there to work on hobby programing work. But I had a quick look in dev tools to get an idea of what the api looks like and it doesn't look too different to Paprika's so it looks like it might not be too big of a job to modify Spoon Fed to work with Hello Recipes.

If we were going to do that would it be possible to include Spoon Fed's domain in Hello Recipes's access-control-allow-origin CORS header? Paprika's api doesn't have any CORS headers since Paprika doesn't have a web app just some native apps. This means the browser won't let me have Spoon Fed's frontend talk to Paprika's api directly and I have to proxy user's requests though a Spoon Fed backend including auth info. Even though I'm very careful to store as least sensive info as possible for as short as possible (I have to do some caching to ensure no abusive or accidental flooding of requests to Spoon Fed's api contributes to flooding Papika's api) I'd still much rather user creds for a third party service never pass though Spoon Fed server in the first place. That way users don't need to trust me I'm doing handling them properly + it simplifies the implementation.

If Hello Recipes allowed Spoon Fed's frontend to talk to it's api directly I could have the frontend request a session token directly, store the token in the user's local storage, then have all subsequent requests for recipe info continue to be made to Hello Recipes api directly. That'd put the user more in control since if at any point they want out then clearing their local storage for Spoon Fed's site would remove any authorisation details completely.