Nobody sets out to adopt an API gateway. You add TLS termination, then a token check, then per-customer rate limits, and at some point the thing in front of your services has become a product decision you never made deliberately.
So I stopped reading feature matrices and priced one fixed workload against every vendor's published rates instead. The short version: 50 million requests a month lands anywhere between $63.50 and $430 depending purely on which billing model you picked, and half the products here will not tell you a price at all. I published the full comparison, including the per-gateway detail, as Best API Gateways in 2026 on DevToolLab. This is the condensed pass.
Everything below was read off each vendor's own pricing page or release feed on September 20, 2026.
Who Actually Runs One
Gateways are not a niche. CNCF and SlashData's State of Cloud Native Development report, published November 11, 2025, found API gateways to be the single most adopted cloud native technology among backend developers at 50 percent, with microservices behind them at 46 percent. The same report counted 15.6 million cloud native developers.
Repository attention lines up roughly with that. On September 20, 2026 Traefik sat at 64,904 GitHub stars, Kong at 44,157, Apache APISIX at 17,147, Tyk at 10,823, and KrakenD Community Edition at 2,684. Stars are not production traffic, but all five shipped a release in the preceding quarter, which is more than you can say for a lot of infrastructure.
Pricing One Month, Four Ways
Tier tables compare tiers. They do not compare bills. So here is a script that prices a single workload against published rates: 50 million requests, 3 KB responses, eight services, one control plane, us-east-1. It prices the vendor invoice only, which is why the self-hosted options read $0 and still cost you compute and an on-call rotation.
// price-gateways.mjs - rates from each vendor's pricing page, September 20, 2026
const reqs = Number(process.argv[2] ?? 50_000_000);
const M = reqs / 1_000_000;
const egressGB = (reqs * 3) / 1_000_000;
const services = 8, controlPlanes = 1;
// AWS: HTTP $1.00/M to 300M then $0.90/M; REST $3.50/M to 333M then $2.80/M; egress $0.09/GB
const awsHttp = Math.min(M, 300) * 1.0 + Math.max(0, M - 300) * 0.9 + egressGB * 0.09;
const awsRest = Math.min(M, 333) * 3.5 + Math.max(0, M - 333) * 2.8 + egressGB * 0.09;
// API7 Cloud: $2 per 1M calls + $250 per gateway group + $10 per service
const api7 = M * 2 + controlPlanes * 250 + services * 10;
// Kong Konnect Plus serverless: $25 per control plane; 2 APIs included,
// then $20/mo for the first 10 total APIs and $10/mo for each extra.
const billable = Math.max(0, services - 2);
const kong = controlPlanes * 25 + Math.min(billable, 10) * 20 + Math.max(0, billable - 10) * 10;
console.log(`${M}M requests/month, ${egressGB} GB egress`);
for (const [n, c] of [["AWS HTTP API", awsHttp], ["AWS REST API", awsRest],
["API7 Cloud", api7], ["Kong Konnect Plus", kong]])
console.log(n.padEnd(20), "$" + c.toFixed(2).padStart(8));
Run it at the baseline, then at ten times the traffic, and the ordering flips:
$ node price-gateways.mjs 50000000
AWS HTTP API $ 63.50
AWS REST API $ 188.50
API7 Cloud $ 430.00
Kong Konnect Plus $ 145.00
$ node price-gateways.mjs 500000000
AWS HTTP API $ 615.00
AWS REST API $ 1768.10
API7 Cloud $ 1330.00
Kong Konnect Plus $ 145.00
Kong Konnect starts out 2.3 times pricier than an AWS HTTP API and ends up under a quarter of it, because Konnect charges per control plane and per published API while AWS charges per request. Whether your invoice tracks your traffic or your org chart matters far more than the headline rate.
Kong Gateway
Built on NGINX and OpenResty, and the plugin catalog is the reason it keeps winning evaluations. It runs either against PostgreSQL or in DB-less mode, which Kong documents as running "without a database using only in-memory storage for entities" from a declarative YAML or JSON file. That second mode is what makes it workable in a GitOps pipeline.
The catch is that Konnect's bill follows environments and teams rather than load, so staging and preview control planes are line items. Apache 2.0, v3.9.3 as of June 17, 2026. Konnect starts at $25 a month per serverless control plane, $200 hybrid, $500 dedicated plus $0.15 per GB.
Traefik
Traefik Proxy is Go, and its pitch is that it writes its own config: label a container or apply an Ingress and the route appears, with Let's Encrypt handled for you. HTTP/2, HTTP/3, TCP, UDP and gRPC are all in the open source build, as are OpenTelemetry traces, metrics and logs.
What you cannot get is a number. Both Traefik Hub tiers swap the price for a "Get Pricing" button, and the WAF, distributed rate limiting and OIDC live behind the first of them. MIT, v3.7.13 as of September 4, 2026.
Apache APISIX
An Apache Software Foundation top-level project that its README describes as built "on top of NGINX and etcd." Using etcd rather than a relational database is the real differentiator: plugins and routes hot-reload across the fleet with nothing to restart and no database in the request path.
The bill for that is operational. You are now running a consensus store, and etcd is usually the first thing to wake you up. Its homepage advertises 100+ plugins, about 18,000 QPS per core and 0.2 ms added latency, all vendor-measured. Apache 2.0, 3.18.0 as of August 20, 2026, with commercial support via API7 at $2 per million calls plus $250 per gateway group and $10 per service monthly.
KrakenD
KrakenD describes itself as "a stateless, distributed, high-performance API Gateway," and it means the stateless part literally: one Go binary, one config file read at boot, no database, no config store. Nodes are immutable and rollbacks are just the previous artifact. API composition is the standout feature, fanning one client request across several backends and merging the response, which deletes an entire backend-for-frontend tier.
The tradeoff is that nothing changes at runtime, so every config edit ships as a deploy. Its own feature matrix marks 71 rows "Not included in Community," service-level rate limiting among them, though endpoint-level rate limiting ships in the free edition. Apache 2.0, Community Edition v2.13.11 as of September 8, 2026, Enterprise priced on request.
Tyk
Tyk has spent two years turning into a control plane for things that are not REST. Native GraphQL was the original hook, and it now ships distinct proxies for Kafka and async streams, MCP tools and registries, and LLM traffic with prompt and cost controls. If a gateway has to sit in front of an agent runtime as well as an API, nothing else here covers as much surface.
Read the license before you commit. The core is MPL 2.0 but the ee directory carries a separate commercial license, so the open source Tyk and the Tyk you trialled may differ. Prices are quoted on request and the free Cloud trial runs 48 hours. 10,823 stars, v5.14.0 as of July 7, 2026.
Amazon API Gateway
If your compute is already Lambda, this is the default and the integration work you skip is worth real money. HTTP APIs are the cheaper of its two REST-shaped products, and the newer Portals feature gives you an AWS-native developer portal without adding a vendor.
It never gets cheaper though. There is no flat tier to graduate onto, so the invoice is a straight line through your traffic graph, and REST APIs cost three and a half times HTTP APIs for largely overlapping features. HTTP APIs run $1.00 per million to 300 million then $0.90, REST APIs $3.50 per million to 333 million then $2.80, with $0.09 per GB egress and a 12-month free tier of a million calls a month.
Picking One Without Migrating Twice
Price your actual last month rather than a tier, because the crossover between metered and flat-rate billing depends entirely on your numbers. Decide whether config changes are allowed to be deploys, since KrakenD insists they are and Kong, APISIX and Tyk hand you an admin API instead. Count the stateful components you are signing up for: PostgreSQL for Kong in traditional mode, etcd for APISIX, nothing for KrakenD or open source Traefik.
Then check the paywall before you prototype, not after. Build the proof of concept on the free edition and confirm rate limiting, OIDC and the developer portal are in the tier you actually plan to buy. And get anything "quoted on request" in writing, renewal uplift included, while you still have leverage.
If you want the per-persona verdicts and the full side-by-side table, they are in the original article.
Two things worth having open while you test: the Rate Limit Header Analyzer for checking that the policy you configured is the one clients actually receive, and the CORS Header Generator for building the Access-Control-Allow-* set once at the edge instead of in every service behind it.
What Changed This Year
Gateways stopped being only about REST. Four of these six now market AI, MCP or LLM proxying, and both Traefik and APISIX sell an AI gateway as its own product. That is where the roadmaps are heading, and it is also where the license boundaries are being redrawn.
The question to ask at renewal is not which has more plugins. It is whether the bill scales with your traffic or with your team. Metered pricing punishes growth; per-control-plane pricing punishes having lots of environments. Model both against next year.
Top comments (0)