Best API Gateways In 2026

Every service that goes public ends up behind something that terminates TLS, checks a token, counts requests per client and picks an upstream. That starts as a load balancer config and becomes a gateway the first time a customer asks for per-tenant rate limits.

Pricing the same 50 million requests a month across the gateways that publish rates produces a spread from $63.50 to $430, and three of the six products here do not publish a price at all. Every figure below was read off the vendor's own pricing page or release feed on September 20, 2026.

What Teams Actually Run

API gateways are the most widely adopted cloud native technology among backend developers, at 50 percent, ahead of microservices at 46 percent. That comes from the State of Cloud Native Development report CNCF and SlashData published on November 11, 2025, which put the cloud native population at 15.6 million developers.

The same report places API gateways in its foundational stage, with Kubernetes and observability a tier above. As of September 20, 2026, Traefik has 64,904 GitHub stars, Kong 44,157, Apache APISIX 17,147, Tyk 10,823 and KrakenD Community Edition 2,684. Stars measure attention rather than production traffic, but all five shipped releases last quarter.

What the Same Month Costs on Each Gateway

Vendor pages compare tiers, not bills. This script prices one fixed workload against each vendor's published rates: 50 million requests a month, 3 KB responses, eight services, one control plane, us-east-1. It prices the gateway bill only, so self-hosted options show $0 and still cost compute and staff.

js
Copy
// price-gateways.mjs - rates read from each vendor's pricing page, September 20, 2026
const reqs = Number(process.argv[2] ?? 50_000_000);
const M = reqs / 1_000_000;
const egressGB = (reqs * 3) / 1_000_000; // 3 KB responses, AWS's own example size
const services = 8, controlPlanes = 1;

// AWS: HTTP $1.00/M to 300M then $0.90/M; REST $3.50/M to 333M then $2.80/M; egress $0.09/GB
const awsHttp = Math.min(M, 300) * 1.0 + Math.max(0, M - 300) * 0.9 + egressGB * 0.09;
const awsRest = Math.min(M, 333) * 3.5 + Math.max(0, M - 333) * 2.8 + egressGB * 0.09;

// API7 Cloud: $2 per 1M calls + $250 per gateway group + $10 per service
const api7 = M * 2 + controlPlanes * 250 + services * 10;

// Kong Konnect Plus serverless: $25 per control plane; 2 APIs included,
// then $20/mo for the first 10 total APIs and $10/mo for every extra.
const billable = Math.max(0, services - 2);
const kong = controlPlanes * 25 + Math.min(billable, 10) * 20 + Math.max(0, billable - 10) * 10;

console.log(`${M}M requests/month, ${egressGB} GB egress`);
for (const [n, c] of [["AWS HTTP API", awsHttp], ["AWS REST API", awsRest],
                      ["API7 Cloud", api7], ["Kong Konnect Plus", kong]])
  console.log(n.padEnd(20), "$" + c.toFixed(2).padStart(8));

At the baseline volume, and again at ten times the traffic:

text
Copy
$ node price-gateways.mjs 50000000
50M requests/month, 150 GB egress
AWS HTTP API         $   63.50
AWS REST API         $  188.50
API7 Cloud           $  430.00
Kong Konnect Plus    $  145.00

$ node price-gateways.mjs 500000000
500M requests/month, 1500 GB egress
AWS HTTP API         $  615.00
AWS REST API         $ 1768.10
API7 Cloud           $ 1330.00
Kong Konnect Plus    $  145.00

The ranking inverts. At 50 million requests Kong Konnect costs 2.3 times an AWS HTTP API; at 500 million it costs less than a quarter as much, because Konnect's serverless line bills per control plane and per published API while AWS meters every request. The billing model decides the winner long before the rate does.

Kong Gateway

Kong Gateway is the NGINX and OpenResty gateway most people mean when they say API gateway, and the plugin catalog is why.

It runs in two shapes that matter. Traditional mode needs PostgreSQL. DB-less mode, in Kong's words, "can be run without a database using only in-memory storage for entities," driven by a declarative YAML or JSON file. Konnect adds a hosted control plane over gateways you still operate.

What it does not do is stay cheap by accident. Konnect bills by control plane, region and published API rather than traffic, so the invoice tracks teams and environments. The plugin surface is also wide enough that two teams will configure auth differently.

Pricing: Gateway free and open source · Konnect 30-day trial at $0, no credit card · serverless control plane $25/month · hybrid $200/month · dedicated cloud gateway $500/month plus $0.15/GB.

License and version: Apache 2.0, 44,157 stars, v3.9.3 as of June 17, 2026.

Traefik

Traefik Proxy is a Go reverse proxy that configures itself from your orchestrator instead of from a file you maintain.

Auto-discovery is the pitch: label a container or apply an Ingress and the route exists, with Let's Encrypt certificates issued automatically. It speaks HTTP/2, HTTP/3, TCP, UDP and gRPC, and ships OpenTelemetry metrics, traces and logs in the open source build.

What it does not do is tell you what the commercial tier costs. Traefik Hub API Gateway and Hub API Management both replace a price with a "Get Pricing" button. The WAF, distributed rate limiting and OIDC sit behind the first paywall; the developer portal and API versioning behind the second.

Pricing: Traefik Proxy free and open source, paid support available · both Hub tiers quoted on request.

License and version: MIT, 64,904 stars, v3.7.13 as of September 4, 2026.

Apache APISIX

Apache APISIX is an Apache Software Foundation top-level project built, in its own README's words, "on top of NGINX and etcd."

Using etcd as the config store is what separates it from Kong: routes and plugins hot-reload across every node with no restart and no relational database in the request path. Its homepage claims over 100 plugins, roughly 18,000 QPS per core and 0.2 ms added latency, which are vendor numbers, not independent benchmarks.

What it does not do is hide the etcd cluster from you. You now operate a consensus store, and etcd is the component most likely to page you. Documentation is patchier than Kong's, and the commercial path runs through API7, a separate company.

Pricing: APISIX free and open source · API7 Cloud $2 per 1M calls, $250/month per gateway group, $10/month per service, plus $200/month for regions outside the standard set.

License and version: Apache 2.0, 17,147 stars, 3.18.0 as of August 20, 2026.

KrakenD

KrakenD calls itself "a stateless, distributed, high-performance API Gateway," and the stateless part is not marketing.

There is no database and no config store. A single binary reads one file at startup, so a node is immutable and a rollback is a previous artifact. Its best feature is API composition: one request fans out to several backends and returns merged, removing a backend-for-frontend service.

What it does not do is change anything at runtime. No hot reload means every change is a deploy, which suits GitOps and frustrates anyone expecting an admin UI. The edition split is wide: 71 rows in KrakenD's feature matrix read "Not included in Community," including service-level rate limiting, though endpoint-level is included.

Pricing: Community Edition free and open source · Enterprise quoted on request, on a model KrakenD says "isn't linked to the number of APIs or throughput."

License and version: Apache 2.0, 2,684 stars, Community Edition v2.13.11 as of September 8, 2026.

Tyk

Tyk is a Go gateway that has spent two years becoming a control plane for protocols that are not REST.

Native GraphQL has been its differentiator for years, and it now ships separate proxies for Kafka and async streams, for MCP tools and registries, and for LLM models with prompt and cost controls. If your gateway must front an agent runtime as well as a REST API, Tyk covers more of that surface than anything else here.

What it does not do is publish prices, and its licensing needs reading. The core is MPL 2.0, but the ee directory carries a separate commercial license, so "open source Tyk" and the Tyk you evaluated are not necessarily the same binary. The free Cloud trial is 48 hours.

Pricing: open source gateway free · Tyk Cloud 48-hour trial · Core and Enterprise quoted on request, described as consumption-based.

License and version: MPL 2.0 core with a commercially licensed ee directory, 10,823 stars, v5.14.0 as of July 7, 2026.

Amazon API Gateway

Amazon API Gateway is the one option here with no server to run and no license to read.

It is the default if your compute is already Lambda: the IAM integration, request authorizers and CloudWatch wiring exist already. HTTP APIs are the cheaper of its two REST-shaped products, and the newer Portals feature adds AWS-native developer portals without a second vendor.

What it does not do is get cheaper at volume. Pricing is per request forever with no flat tier, so the bill is a straight line through your traffic chart: $615 a month at 500 million requests against $145 for a flat-rate control plane. REST APIs also cost three and a half times HTTP APIs for overlapping functionality.

Pricing: HTTP APIs $1.00 per million to 300 million, then $0.90 · REST APIs $3.50 per million to 333 million, then $2.80 · data transfer out $0.09/GB · free tier of 1 million calls a month for 12 months.

License and version: proprietary managed service, us-east-1 rates as of September 20, 2026.

Side by Side

How to Choose Without Migrating Twice

1. Price your real last month, not a tier. Run the script above with your actual request and service counts. The crossover between metered and flat-rate billing is specific to your traffic.
2. Decide whether config changes are deploys. KrakenD says yes and makes it fast; Kong, APISIX and Tyk hand you an admin API instead. Pick the one matching how you already ship.
3. Count the stateful components you are adding. Kong traditional mode adds PostgreSQL, APISIX adds etcd, KrakenD and open source Traefik add nothing.
4. Check what is behind the paywall before you prototype. Build the proof of concept on the open source edition, then confirm rate limiting, OIDC and the developer portal are in the tier you will buy. KrakenD's 71 Enterprise-only rows and Traefik's paid WAF are the usual surprises.
5. Get a written quote for anything "on request." Traefik Hub, Tyk and KrakenD Enterprise publish no price. Get the number, with the renewal uplift, while you still have alternatives.

Which One Should You Actually Use?

Already all-in on AWS Lambda: Amazon API Gateway on HTTP APIs, not REST APIs. The integration work you skip outweighs the metered pricing until a few hundred million requests a month.

Running Kubernetes and want one less component: Traefik. It is probably already your ingress controller, and the open source build covers routing, TLS and observability until you need a developer portal.

High traffic on a flat budget: Kong Konnect, or self-hosted Kong Gateway in DB-less mode. Per-control-plane pricing stops tracking traffic, which is what you want when traffic only goes up.

Latency-sensitive, GitOps-native, no appetite for another datastore: KrakenD Community Edition. A stateless binary with one config file is the cheapest thing here to operate.

Fronting GraphQL, Kafka or an agent runtime: Tyk. The only one with first-class GraphQL, MCP and LLM proxies in one control plane, worth the pricing opacity if it removes a second product.

Conclusion

What changed this year is that gateways stopped being only about REST. Four of the six here now advertise AI, MCP or LLM proxying, and Traefik and APISIX sell an AI gateway as a distinct product. That is where the roadmaps and the license lines are moving.

The question to ask before renewing is simpler than any feature matrix: does this bill scale with our traffic or with our team? Metered gateways punish success; flat-rate control planes punish fragmentation. Price both against next year's traffic.

Related DevToolLab Tools

• Rate Limit Header Analyzer - decode the X-RateLimit and RateLimit headers your gateway returns and confirm the policy you set is the one clients see.
• CORS Header Generator - build the Access-Control-Allow-* set once at the gateway instead of in every upstream service.
• Swagger Viewer - read the OpenAPI spec you are about to import into Kong, Tyk or API7 before the gateway rejects it.
• Security Headers Checker - verify the headers your gateway should add are present on a live endpoint.

Related Guides

• Best LLM Gateways and API Routers in 2026 - what changes when the upstream is a model provider instead of a microservice.
• Rate Limiting Algorithms: 5 Compared - the token bucket and sliding window math behind the rate limiting these gateways ship.
• Best API Testing Tools in 2026 - testing the APIs you put behind one of these.
• Webhooks vs APIs - when the answer is not a gateway at all.