Assuming that a third-party API does not have an API key or any forms of auth, does the JavaScript fetch() method avoid rate limits since it is performed client side?
For instance, suppose there is an API with a rate limit of 100 req/day.
A React + Node application with the Node server getting rate limited means all users will receive errors since the Node server IP is blocked; however, if I make fetch() calls client side, does this bypass rate limits?
No, the client also it is behind an IP that can be blocked.
It depends entirely on how the rate limiting is applied.
If they limit on a per API key basis then making the requests from different clients on different IP addresses wouldn't make a difference.
If they limit on a per IP address basis, then it would.
100 requests from the same client (or other clients sharing the same Internet-facing IP address) would still hit the limit, of course.