If it's just for the API within your mobile app I would go for a self signed certificate. Make sure the app verifies that the signature is the correct one, and

If it's just for the API within your mobile app I would go for a self signed certificate. Make sure the app verifies that the signature is the correct one, and you should be good to go. The reason I recommend this is because you are in control of the client, so you do not need to rely on a third party for trust. That, and it's free.