A well-designed API makes both web and mobile clients easier to build and maintain. We recommend REST with clear resource naming, consistent status codes, and versioning in the URL path.
Use JSON for request and response bodies, and document everything with OpenAPI or similar. For auth, prefer tokens (e.g. Laravel Sanctum) with short expiry and refresh flows.
Finally, add rate limiting and CORS from day one so you don't have to retrofit later.