• Create test case(s) using PHP and/or Node.js to get an idea of app responsiveness and interaction issues.
• Attach WebSockets, Server-sent events, long polling, or similar to determine multiple client behavior and scalability.

• Persistence: config file or sqlite w/nice wrapper
• Security model alternatives:
  • Accept connections only from localhost? CORS?
  • Password (in request) or API key (basic auth) property in app?
  • Notify and accept (cookie/session)?
  • Firewall
• Embedded (i.e., one-and-only-app) vs. desktop app

• Attractive because it facilitates a lot of web developers get into embedded development (i.e., lots of devs know PHP very well).
• What server?
  • Is the built-in server good enough for a limited number of connections?
  • Is there a native PHP server that is good enough?
  • nginx
  • lighttpd
  • Bitnami?
• What PHP?
  • Can “standalone” PHP be installed easily? Or is it best to use the global PHP? (Easy for Linux, dunno about Windows & MacOS.)

The above are not issues for embedded application as the machine's global Apache (or whatever) server and PHP can be used.

• Frameworks
  • Silex
    • Good community support.
    • Good Composer and module support.
    • Documentation is a bit obtuse.
    • Out of the box twig support. Redbean support is available.
    • Has a good ReST code structure but you wouldn't know it from the docs.
  • Slim
    • Slim 3 has removed some functionality that might be good to have.
  • Fat Free Framework
    • Compact, more than what's needed.
    • Excellent ReST code structure.
    • Twig and Redbean support are available.
    • Not sure Composer is well supported.
  • Check cookies/session (secure) support.
• Persistence
  • Redbean
  • ini and other format file (search Packagist for ini and config).
    • hassankhan/config looks good.
  • text file with native functions and this.

• Doesn't have the “which server?” issue as the script is the server.
• There is also a “persistence” advantage in that app vars can be used to deliver same data to many clients.
• Frameworks
  • I don't see much reason not to use Express.js.
  • Persistence
    • My config file bookmarks
    • My sqlite bookmarks

• Python is attractive because RPi developers will know it.
• Flask and Flask-RESTful are a good combination.
• Has a development server that might be good enough for a limited number of clients.
• Has the “persistence” advantage of Node.js (if run on development server?)
• Config files and sqlite are TODO.

• To be served or simply loaded from file?
  • I suspect the former is better because of security/CORS/whatever.
  • If served, by a separate server or by the same server that's handling the API?