Usually in web.php, because routes will use the web middleware to access the session and other Internet-related middleware (CSRF ecc ..)
api.php designed for stateless API calls in which you do not want to use a session, but instead use non-standard functions such as api authentication throttle, etc.
Moppo source
share