If I need to expose an internal API running on a server within my private network to a limited set of external partners, which Cloudflare service would be most appropriate and why?

For exposing an internal API on a private network to a limited set of external partners, Cloudflare Tunnel combined with Cloudflare Access would be the most appropriate. The Tunnel securely connects the API server to Cloudflare without opening firewall ports, while Cloudflare Access allows you to define granular, identity-based policies to ensure only authorized partners (based on their identity, device posture, etc.) can reach the API, enforcing a Zero Trust model. A Load Balancer is not strictly necessary unless you have multiple instances of that API for high availability.