When to Use REST, WebSockets, SSE, and gRPC

Choose the simplest shape

REST is a strong default for resource-oriented request and response workflows. Server-sent events work well when the server needs to push a one-way stream to a browser. WebSockets are useful when both sides need an ongoing conversation.

gRPC can be an excellent internal contract when typed service calls and streaming matter, but it does not automatically make a public browser API better.

Recovery is part of the choice

Ask how a client reconnects, catches up, authenticates, and knows whether it missed an event. A protocol that is fast in the happy path but vague after disconnect is an incomplete design.

The best choice is usually the one the team can observe and operate confidently.

Choose by communication shape

The protocol should answer how data moves, how clients reconnect, and who owns the connection. REST is usually the clearest choice for resource operations. Server-sent events are a good browser primitive for one-way updates. WebSockets are useful when the client must send messages continuously. gRPC is compelling for typed service-to-service calls and streaming inside a controlled environment.

flowchart TD
  A[Communication need] --> B{Resource request and response?}
  B -->|Yes| C[REST]
  B -->|No| D{Server pushes one-way browser updates?}
  D -->|Yes| E[SSE]
  D -->|No| F{Two-way long-lived session?}
  F -->|Yes| G[WebSocket]
  F -->|No| H{Typed internal service contract?}
  H -->|Yes| I[gRPC]
  H -->|No| C

Recovery is part of the choice

Ask how a client reconnects, catches up, authenticates, and knows whether it missed an event. A protocol that is fast in the happy path but vague after disconnect is an incomplete design.

const source = new EventSource(`/api/assets/${assetId}/events`);
source.addEventListener("asset.updated", (event) => {
  const update = JSON.parse(event.data) as AssetUpdate;
  applyIfNewer(update);
});
source.onerror = () => showConnectionState("reconnecting");

The transport does not define delivery guarantees by itself. The application still needs event IDs, sequence numbers, authorization, and a catch-up path.