I have been thinking about this one. It is tempting to go with the all-in-one but what if your api grows and you need to use it outside of your application. I have worked for a few different companies that allowed external access to the API only. I know that it would still be available going this route but managing it may be a bit more complicated.