Use Server Actions for server-only mutations tied to forms/UI (you still validate and authorize). Use Route Handlers when you need a general HTTP API (public clients, webhooks, third parties, custom methods/headers) or non-form flows like uploads.