@randometc not enough space to go through all the details, unfortunately. But two things those touch on are:
* Are there technical constraints you must align with
* Are there expectations of your consumers
Just some examples of what to consider - Internal APIs either have existing infra and/or people to operate something like Kong. External API need user sign up while internal apps probably HAVE TO use corporate SSO. Web apps are probably all client-side JS, so gRPC is very hard to consume.