The dividing line is who calls it.

Server Actions — your own UI calls it. Mutations from forms and client components, where you want the closure over server code, automatic revalidation, and no hand-written fetch.

Route Handlers — something that is not your React tree calls it. Third-party webhooks, OAuth callbacks, mobile clients, cron jobs, anything needing a stable public URL, custom headers, or a non-JSON response.

A useful check: if you would ever want to curl it, make it a route handler.

Worth adding that server actions are POST-only under the hood, so anything that needs to be cacheable or GET-addressable has to be a route handler regardless of who calls it.