Yeah makes sense.. For my vue.js app I used a suitelet and just make it available externally on sandbox for development but your approach is more secure