Yes, for all your requests for normal web applications, use web.php. If you have a mobile app (iOS, Android for example) define your routes in api.php, so use both files.
I have my CMS routes all defined in web.php, and for the mobile apps I define my route calls in api.php.
@tyris
No, you can perfectly define your routes for your ajax request in web.php
But using api.php has some advantages:
routes are automatically prefixed with 'api/'
routes are using auth and api middle ware
-- auth -> checks for a token
-- api middleware adds some additional security/protection by throttling api request. So a client can request a route only x time per minute