[plq]

Avoiding SSL on the grounds of its overhead is premature optimization. Unless profiling reveals that the SSL overhead introduces significant delays (and the cost of getting a proper SSL Certificate is affordable) there's no reason to go without SSL.

[DomreiRoam]

If you want to use caching for multiple clients; I don't think you can use SSL. So it depends a lot about the purpose of the API.

[traveldotto1]

it's all depending on use cases.. that is why I don't think an API should be secured through SSL from day one.. here is an example how SSL can be unnecessary, if i am processing billions of ad request daily with a response time of less than few milliseconds, and operates in a secured environment, why would i need to add a layer of SSL on all the requests..

Use cases drive requirements, not buzz words drive requirements, and that's my whole point