Practical considerations.
WHAT WORKS
A PHP API using any framework, or none. This is ordinary web request handling and runs well.
AUTHENTICATION
Use tokens rather than passwords in requests. Issue per-client tokens that can be revoked individually.
Never accept credentials over plain HTTP. Enforce HTTPS.
RATE LIMITING
Essential. Without it, one client can consume your entire resource allowance.
Implement at the application level, tracking requests per token in cache or database.
RESOURCE AWARENESS
Every API request runs full application code, since responses are usually not cacheable in the ordinary sense.
Cache what you can: responses that are identical for all clients, or that change infrequently.
TIMEOUTS
If your API calls other services, set timeouts. Otherwise a slow upstream service holds your processes open and exhausts entry processes.
WHAT DOES NOT WORK WELL
Websockets and long-polling, which need persistent connections Very high request volumes, which exhaust shared limits
DOCUMENTATION
Document endpoints, authentication, rate limits and error formats. An undocumented API generates support requests.
