API Gateway

Kong44.2k★

Kong is an API gateway that sits between your clients and services, handling authentication, rate limiting, logging, transformations, and load balancing. It sits between your clients and your services and manages traffic, security, and observability in one place. Kong Gateway (OSS) is free and covers the fundamentals: request routing, load balancing, health checks, and a plugin system with 30+ free plugins (rate limiting, key auth, JWT, CORS, request transformation, logging). It runs on OpenResty/Nginx, so it's fast. Configuration via a REST Admin API or declarative YAML. Kong Enterprise (Kong Konnect) adds the management UI, developer portal, Vitals analytics, RBAC, OpenID Connect, and a managed control plane. Pricing is custom but typically starts around $15K+/year. Solo: probably overkill. Use a reverse proxy. Small teams: Kong OSS works well for <20 services. Growing teams: evaluate Konnect when you need the dashboard. Large orgs: Kong is industry standard at this tier. The catch: Kong without the management UI means configuring everything via API calls or YAML. That's fine for a few services but becomes painful at scale. The plugin ecosystem is powerful but writing custom plugins requires Lua knowledge (or Go/Python with newer PDK). If you want a simpler API gateway, APISIX or even Caddy with plugins might be less overhead.

APISIX17.2k★

APISIX is an API gateway built on Nginx and Lua that sits in front of your microservices, handling routing, authentication, rate limiting, and payload transformation fast enough for serious traffic. It routes API calls to the right backend service and applies policies (auth, rate limits, logging) without changing your application code. Fully free under Apache 2.0. APISIX is an Apache Software Foundation project with no commercial entity gating features. You get the full gateway: dynamic routing, load balancing, 80+ plugins (auth, observability, traffic control), gRPC support, and a dashboard. Plugins are hot-reloadable, no restarts required. The catch: the Lua/OpenResty foundation is niche. If your team doesn't know Lua, writing custom plugins is a steep learning curve. Envoy and Traefik have larger communities and more ecosystem integrations. And while APISIX is fast, the operational complexity of running an API gateway at scale (high availability, configuration management, monitoring) is real regardless of which tool you pick.

nango12.3k★

Nango handles the part of product integrations nobody wants to own: OAuth, token refresh, and credential storage across 900-plus APIs. You embed a white-label auth flow, users connect their Salesforce or Gmail account, and Nango keeps those tokens alive per tenant. A proxy then makes authenticated calls on their behalf, resolving the provider, injecting credentials, and handling retries and rate limits. Beyond auth there are functions: integration logic written as TypeScript that deploys to Nango's runtime with built-in retries, storage, and observability, plus syncs that continuously reconcile only the records that changed. Replit, Ramp, and Mercor run it in production, which is a real signal for infrastructure this boring and this load-bearing. Self-hosting is supported and the source is public, so a small team can run it without paying. The catch is the license, and it is the whole story. Nango is Elastic License 2.0, not open source: you may not offer it to third parties as a hosted or managed service, and you may not disable the license key functionality. Fine for using it in your product, disqualifying if you planned to build a service on it.

tyk10.8k★

Tyk is an API gateway that sits in front of your services and handles authentication, rate limiting, analytics, and versioning. Consider it a bouncer for your API: checks credentials, enforces quotas, logs everything. Go-based. Tyk's open source gateway handles the core job: proxying requests, applying rate limits, key authentication, and basic analytics. It's Docker-friendly and runs as a single binary. The open source gateway is free under a modified license (check the terms; it's not a standard permissive license). The paid tiers add a management dashboard, developer portal, multi-data-center support, and enterprise SSO. Tyk Cloud starts around $500/mo. Self-hosted pro licenses are custom-quoted. Solo or small teams: the free gateway handles basic API management fine. You configure it via API calls or config files, no GUI. Medium teams: you'll probably want the dashboard once you're managing 10+ APIs. Large orgs: the enterprise features (RBAC, federation, portal) justify the cost. The catch: the free tier is deliberately limited to push you toward paid. No dashboard, no developer portal, no visual API designer. The licensing is also murky, not Apache or MIT, so check compliance before deploying commercially. Kong is the more common open source choice with a clearer license story.

unkey5.4k★

Unkey handles the unglamorous parts of running a public API: issuing and revoking API keys, rate limiting per customer, and per-key usage analytics. It has since grown into a platform that also deploys your API and routes traffic through its own gateways. The code is AGPLv3, and hosted API management is free up to 150K valid requests a month. Self-hosting is legal but not the paved road. The README offers no packaged install, and the local dev stack runs on Kubernetes through Tilt with MySQL and ClickHouse behind it. Plan for real ops work if you go that way. Paid API management starts at $25/mo for 250K valid requests and scales to $1,000/mo for 100M, adding 7-day logs and team workspaces. Solo builders launching a paid API fit the free tier. Small and medium teams get a lot for $25. Large teams that want the gateway inside their own network should compare Kong and Apache APISIX, which self-host far more easily. The catch is governance. Unkey has stopped accepting outside pull requests while the team focuses on platform direction, and its focus has widened from key management to hosting your API. Open source you cannot contribute to is worth weighing before you build on it.

agentgateway5.0k★

AgentGateway is one control point for everything your agents talk to. Route calls to OpenAI, Anthropic, Gemini, or Bedrock through a single OpenAI-compatible API with budget and spend controls attached, proxy the MCP servers your agents pull tools from, and carry agent-to-agent A2A traffic on the same path. Guardrails, JWT and OAuth auth, RBAC through a CEL policy engine, rate limits, and OpenTelemetry tracing all attach in one place instead of thirteen. Apache-2.0, written in Rust, free. You run the gateway process and repoint clients at it rather than at each provider and each server directly. That is one more component to operate, which is the trade: accept a hop so you stop scattering API keys, spend limits, and tool credentials across every agent config. It also does inference routing to self-hosted models through Kubernetes Inference Gateway extensions, deciding by GPU utilization, KV cache, and queue depth, though that only matters if you run your own inference. The reason most teams install it is spend. Once several agents are burning tokens against several providers, nobody can answer what anything cost, and per-route budget controls fix that faster than any dashboard will. With one provider and a couple of MCP servers this is overhead you do not need. The catch is the extra hop: when a call fails you now have two places to look, and the gateway is the one nobody thinks to check first.

emissary4.5k★

Emissary-ingress is an API gateway built on Envoy Proxy. It handles routing, TLS termination, rate limiting, authentication, and load balancing for traffic entering your Kubernetes cluster. It's the front door to your cluster that decides which request goes where. Fully free under Apache 2.0. CNCF incubating project. You get the full gateway: path-based routing, header-based routing, gRPC support, WebSocket support, automatic TLS with Let's Encrypt, rate limiting, and OAuth2 integration. Configured via Kubernetes CRDs (Custom Resource Definitions). The catch: Emissary's development has slowed significantly. Ambassador Labs (the company behind it) has shifted focus to Telepresence and their commercial products. The Kubernetes gateway API is becoming the standard, and newer ingress controllers (like Envoy Gateway, which is also Envoy-based) are more actively developed. If you're starting fresh, Envoy Gateway or Traefik are better bets. If you're already running Emissary, it works, but plan a migration timeline.