Apache APISIX vs. Envoy

Apache APISIX is purpose-built as an API gateway. It runs on NGINX/OpenResty with LuaJIT for plugin execution and etcd for configuration storage. The architecture separates data plane (stateless APISIX nodes) from control plane (etcd + optional dashboard), enabling horizontal scaling without database bottlenecks. Configuration changes propagate via etcd watch in milliseconds — routes, plugins, and upstreams update without restart.

Envoy is a general-purpose L4/L7 proxy designed by Lyft as a universal data plane. Written in C++ for raw performance, it uses xDS (discovery service) APIs for dynamic configuration. Envoy does not include a built-in control plane — it relies on external systems like Istio, Gloo Edge, or custom xDS servers to manage its configuration. This makes Envoy extremely flexible but increases operational complexity for teams that need API gateway functionality out of the box.

The key difference: APISIX is a batteries-included API gateway with admin API, plugin management, and consumer authentication built in. Envoy is a programmable proxy that requires a control plane to become a complete API gateway. For teams that want production-ready API management without assembling a control plane, API7 Enterprise provides the complete solution built on APISIX.

Apache APISIX delivers 23,000 QPS per core with 0.2ms average latency in published benchmarks. Its NGINX event loop handles thousands of concurrent connections efficiently, and LuaJIT-compiled plugins execute with near-native speed. The etcd-backed configuration adds negligible overhead since config is cached locally on each node.

Envoy also delivers high throughput thanks to its C++ implementation and asynchronous event-driven architecture. In raw proxy benchmarks, Envoy and APISIX perform comparably at the L4/L7 layer. However, Envoy's per-connection memory footprint is typically higher than NGINX-based proxies due to C++ object overhead, which matters at scale with tens of thousands of concurrent connections.

Where APISIX gains a clear advantage is plugin execution overhead. LuaJIT plugins in APISIX add minimal latency per plugin in the chain. Envoy's C++ filters are fast but hard to write, Lua filters are limited in scope, and Wasm plugins — while improving — still add measurable overhead per filter invocation compared to native LuaJIT.

APISIX ships with 100+ plugins covering authentication (JWT, OAuth2, OIDC, HMAC), traffic control (rate limiting, circuit breaking, request mirroring), observability (Prometheus, OpenTelemetry, SkyWalking), and AI/LLM proxying. All plugins are open-source with no enterprise paywall. Custom plugins can be written in Lua, Go, Wasm, Python, JavaScript, or Java and loaded at runtime without gateway restart.

Envoy's extensibility model centers on C++ filters for maximum performance. Writing a C++ filter requires deep knowledge of Envoy's internal APIs and build system — a high barrier for most teams. Envoy also supports Lua filters (simpler but limited to header/body manipulation) and Wasm plugins via the Proxy-Wasm specification. The Wasm ecosystem is growing but remains less mature than APISIX's multi-language plugin runtime.

For teams that need to add custom business logic to their API gateway — rate limiting rules, custom auth, request transformation, or AI prompt routing — APISIX's approach is significantly more accessible. A Go or Python developer can write and deploy an APISIX plugin in hours; an Envoy C++ filter typically takes days.

Envoy is the dominant service mesh data plane. It powers Istio (the most popular service mesh), Consul Connect, AWS App Mesh, and Open Service Mesh. If your organization has committed to a service mesh architecture, Envoy is likely already in your stack as a sidecar proxy handling east-west traffic between services.

Apache APISIX focuses primarily on north-south traffic — API gateway, Kubernetes ingress, and edge proxy use cases. APISIX provides a native Kubernetes Ingress Controller and supports the Gateway API specification. For service mesh use cases, APISIX Mesh can act as a sidecar, though it has smaller adoption compared to Envoy-based meshes.

Many production architectures use both: Envoy as sidecar proxy for east-west service mesh traffic (managed by Istio), and Apache APISIX/API7 Enterprise as the API gateway for north-south ingress traffic. This combination provides the best of both worlds — Envoy's mesh capabilities with APISIX's superior API management, plugin ecosystem, and operational simplicity.

Choose Apache APISIX if you need a production-ready API gateway with built-in admin API, 100+ plugins, dynamic configuration, and multi-language plugin support. APISIX excels as a Kubernetes ingress controller, edge gateway, and north-south API management layer. It is the best choice when you want API gateway functionality without assembling a separate control plane.

Choose Envoy if you are building a service mesh architecture and need a universal L4/L7 sidecar proxy. Envoy is the right choice when you already use Istio or another Envoy-based control plane, need xDS-driven configuration, or require deep L4 protocol support (Redis, MongoDB, MySQL protocol-aware proxying). Envoy is strongest as a data plane component within a larger platform.

Choose API7 Enterprise if you want Apache APISIX's performance and extensibility with enterprise-grade management — visual dashboard, FIPS 140-2 compliance, RBAC, audit logging, and commercial support. API7 is the production-hardened distribution of APISIX for organizations that need API gateway functionality at scale. Contact API7 for a technical evaluation.