@nakov, I'm using a mix of them all, although I sort of had it in my head to use the api for external, 3rd party apps and then web.php for internal things
@nakov am I right in saying auth would be the same as an external application for within laravel, requiring sending a request to the oauth/token endpoint to get a token then send API requests with that token?
Well no, from within Laravel you would use a session based authentication, but for the external apps, there is Laravel passport which offers token based authentication. If you mean will it be the same User, then yes, you don't have to have two separate users to use each of the authentications, but for the web app for example there will be a session based authentication using email and password, and when the user registers you can create a token for the user, and use that one to authenticate the same user for a mobile app let's say, or whatever 3d party app.