API Gateway

Kong44.4k★

Kong is an API gateway that sits between your clients and services, handling authentication, rate limiting, logging, transformations, and load balancing. It sits between your clients and your services and manages traffic, security, and observability in one place. Kong Gateway (OSS) is free and covers the fundamentals: request routing, load balancing, health checks, and a plugin system with 30+ free plugins (rate limiting, key auth, JWT, CORS, request transformation, logging). It runs on OpenResty/Nginx, so it's fast. Configuration via a REST Admin API or declarative YAML. Kong Enterprise (Kong Konnect) adds the management UI, developer portal, Vitals analytics, RBAC, OpenID Connect, and a managed control plane. Pricing is custom but typically starts around $15K+/year. Solo: probably overkill. Use a reverse proxy. Small teams: Kong OSS works well for <20 services. Growing teams: evaluate Konnect when you need the dashboard. Large orgs: Kong is industry standard at this tier. The catch: Kong without the management UI means configuring everything via API calls or YAML. That's fine for a few services but becomes painful at scale. The plugin ecosystem is powerful but writing custom plugins requires Lua knowledge (or Go/Python with newer PDK). If you want a simpler API gateway, APISIX or even Caddy with plugins might be less overhead.

APISIX17.3k★

APISIX is an API gateway built on Nginx and Lua that sits in front of your microservices, handling routing, authentication, rate limiting, and payload transformation fast enough for serious traffic. It routes API calls to the right backend service and applies policies (auth, rate limits, logging) without changing your application code. Fully free under Apache 2.0. APISIX is an Apache Software Foundation project with no commercial entity gating features. You get the full gateway: dynamic routing, load balancing, 80+ plugins (auth, observability, traffic control), gRPC support, and a dashboard. Plugins are hot-reloadable, no restarts required. The catch: the Lua/OpenResty foundation is niche. If your team doesn't know Lua, writing custom plugins is a steep learning curve. Envoy and Traefik have larger communities and more ecosystem integrations. And while APISIX is fast, the operational complexity of running an API gateway at scale (high availability, configuration management, monitoring) is real regardless of which tool you pick.

nango13.1k★

Nango handles the part of product integrations nobody wants to own: OAuth, API keys and token refresh across 1,000-plus APIs. Users connect their Salesforce or Gmail through a white-label flow, Nango keeps tokens alive, and its proxy makes authenticated calls with retries and rate limits handled. You write syncs, actions and agent tool calls as TypeScript functions on Nango's runtime. Both the cloud and a limited self-host are free to start. Free self-hosting is one docker-compose up, but the docs pitch it for hobby projects and it covers Auth and Proxy only: no syncs, tool calls, webhooks, MCP server or RBAC. The full self-hosted build is Enterprise-only. Cloud is the real product. Free is $0 with hard caps (10 connections, 10 compute hours, 10GB a month). Pay-as-you-go is $50/mo including $50 of usage, at $0.29 per connection. Solo and prototypes: free. Small teams: pay-as-you-go. Need SSO: the $450/mo Growth add-on. Larger teams: Enterprise. The catch: the README calls Nango fully open source, but it's Elastic License 2.0, which bars offering it as a hosted service. And Nango published ten security advisories in August and September 2026, including a critical SSRF and an unauthenticated SQL injection. Self-hosters before v0.71.9: upgrade now.

tyk10.9k★

Tyk is an API gateway that sits in front of your services and handles authentication, rate limiting, analytics, and versioning. Consider it a bouncer for your API: checks credentials, enforces quotas, logs everything. Go-based. Tyk's open source gateway handles the core job: proxying requests, applying rate limits, key authentication, and basic analytics. It's Docker-friendly and runs as a single binary. The open source gateway is free under a modified license (check the terms; it's not a standard permissive license). The paid tiers add a management dashboard, developer portal, multi-data-center support, and enterprise SSO. Tyk Cloud starts around $500/mo. Self-hosted pro licenses are custom-quoted. Solo or small teams: the free gateway handles basic API management fine. You configure it via API calls or config files, no GUI. Medium teams: you'll probably want the dashboard once you're managing 10+ APIs. Large orgs: the enterprise features (RBAC, federation, portal) justify the cost. The catch: the free tier is deliberately limited to push you toward paid. No dashboard, no developer portal, no visual API designer. The licensing is also murky, not Apache or MIT, so check compliance before deploying commercially. Kong is the more common open source choice with a clearer license story.

agentgateway6.0k★

agentgateway is one proxy for everything your AI agents talk to: LLM providers, MCP tool servers and other agents. Apps hit one OpenAI-compatible endpoint that routes to OpenAI, Anthropic, Gemini or Bedrock, with failover, rate limits, guardrails, auth and tracing in one place. Solo.io created it, the Linux Foundation now hosts it, and it's free under Apache 2.0. Standalone, it's one Rust binary driven by a YAML file, with a built-in UI. On Kubernetes there's a controller with Gateway API support. Since 1.6 it prices requests to common public models out of the box, so per-key dollar budgets work without building a cost table first. Only need the LLM side? LiteLLM is the obvious alternative. Everything above is in the free build. Solo Enterprise adds MCP tool registration and fingerprinting, hardened builds and 24x7 support, quote only. Solo and small teams: free. Larger teams needing a vendor on the hook: get a quote. The catch: it's young and moving fast for something in your auth path. Five security advisories in 2026, including a high-severity bug before 1.4.0 where a reused MCP session picked up another route's authorization policy. Minor releases break things, so pin versions.

unkey5.5k★

Unkey handles the unglamorous parts of running a public API: issuing and revoking API keys, rate limiting per customer, and per-key usage analytics. It has since grown into a platform that also deploys your API and routes traffic through its own gateways. The code is AGPLv3, and hosted API management is free up to 150K valid requests a month. Self-hosting is legal but not the paved road. The README offers no packaged install, and the local dev stack runs on Kubernetes through Tilt with MySQL and ClickHouse behind it. Plan for real ops work if you go that way. Paid API management starts at $25/mo for 250K valid requests and scales to $1,000/mo for 100M, adding 7-day logs and team workspaces. Solo builders launching a paid API fit the free tier. Small and medium teams get a lot for $25. Large teams that want the gateway inside their own network should compare Kong and Apache APISIX, which self-host far more easily. The catch is governance. Unkey has stopped accepting outside pull requests while the team focuses on platform direction, and its focus has widened from key management to hosting your API. Open source you cannot contribute to is worth weighing before you build on it.

emissary4.5k★

Emissary-ingress is an API gateway built on Envoy Proxy. It handles routing, TLS termination, rate limiting, authentication, and load balancing for traffic entering your Kubernetes cluster. It's the front door to your cluster that decides which request goes where. Fully free under Apache 2.0. CNCF incubating project. You get the full gateway: path-based routing, header-based routing, gRPC support, WebSocket support, automatic TLS with Let's Encrypt, rate limiting, and OAuth2 integration. Configured via Kubernetes CRDs (Custom Resource Definitions). The catch: Emissary's development has slowed significantly. Ambassador Labs (the company behind it) has shifted focus to Telepresence and their commercial products. The Kubernetes gateway API is becoming the standard, and newer ingress controllers (like Envoy Gateway, which is also Envoy-based) are more actively developed. If you're starting fresh, Envoy Gateway or Traefik are better bets. If you're already running Emissary, it works, but plan a migration timeline.

llmgateway1.7k★

LLM Gateway sits between your app and the model providers: one OpenAI-compatible API that routes to OpenAI, Anthropic, Google and dozens more and tracks tokens and cost in one dashboard. It's an open source answer to OpenRouter, in the same lane as LiteLLM and Portkey, and the core is free under AGPLv3. Self-hosting is one Docker image with Postgres and Redis inside, or a Helm chart when you mean it. The docs say to move Postgres and Redis to managed services for production, and releases land weekly, so upgrades are a standing chore. Hosted has no subscription: provider token rates plus a flat 5% fee when you buy credits, and routing with your own keys is free. Enterprise (custom pricing) adds SSO, audit logs, guardrails and full payload retention, and self-hosters need a signed license for those. Solo: free hosted with your own keys. Small teams: self-host free. Larger teams: Enterprise once SSO and audit trails are requirements. The catch: this layer holds every provider key and sees every prompt. August 2026 alone brought a critical cross-tenant API key bug and a cache that could hand one tenant's responses to another. All patched, but self-hosted, the upgrade cadence is yours.