The total.js is well designed, and very fast nodejs framework. You can extend or replace anything: serving static files, generating e-tags, authentication, authorization, controller behaviors, etc. Total.js represents a nice modularity approach. You can use modules or the whole packages to extend CMC functionality.
API is very useful when you need to migrate content, run scheduled tasks, or do something from the outside. Every user has auto-generated API key. If you want to activate it, just define IPs from which requests are allowed, or simple type “*” to allow any IP. After that you can request all CMS resources used by admin area path (/admin/…).