This comparison comes up constantly with clients deciding how to build a new site, and the honest answer is neither option is universally better. Each one wins depending on what you actually need. Here is a real breakdown, not a framework sales pitch...

An API route with no rate limiting works fine right up until someone hits it a thousand times a second, either by accident a buggy client retry loop or on purpose. I learned this the annoying way, watching a client's database bill spike because a pub...