You can do this with a non-SPA website just fine if the website's backend is the API client. Sure, it adds an extra layer of indirection between the browser and your data, but if the separation of concerns is really your goal, then that's probably as good as it gets.