I'm creating a backend API for a mobile app. Instead of mydomain.com/api ... is it okay and technically viable, for example, to use 415.21.23.235/api instead? Are there any security risks, downtime, disadvantages, etc?
That's technically fine. One disadvantage / risk that I can think of is in the event that you wanted to move to different VPS (new droplet or different host all together). This would issue a new IP address making your original URL invalid so anyone using your API would have to make an update. With the domain this wouldn't be an issue since the IP change would happen at the DNS level.
The disadvantage is durability and scaling - in a way.
If you link a domain to it, then you can host the app anywhere and move it around from different providers even because all you have to do is change an A record for your DNS.
Of course, the advantage is that on the consumer end a DNS lookup does not need to happen but this is a very, very small advantage.