Apache APISIX vs Envoy: API Gateway vs Universal Proxy (2026)
By API7.ai Team
Last updated: June 2026
Apache APISIX and Envoy are both high-performance, cloud-native proxies, but they target different layers of the stack. APISIX is a full-featured API gateway with a built-in control plane; Envoy is a universal L4/L7 data plane best known for powering service meshes. This guide compares architecture, performance, extensibility, observability, and API management.
Apache APISIX is a batteries-included API gateway (NGINX/OpenResty + etcd, 100+ plugins, built-in admin API) best for north-south traffic and Kubernetes ingress. Envoy is a C++ universal proxy and the dominant service mesh data plane, but it needs an external control plane to act as a gateway. Many teams run both — Envoy for the mesh, APISIX for the API gateway.
- API gateway & Kubernetes ingress out of the box: Apache APISIX
- Service mesh sidecar / universal data plane: Envoy
- Mesh for east-west and a gateway for north-south: Run both (Envoy + APISIX)
Apache APISIX vs Envoy at a glance
Apache APISIX is a complete API gateway with a built-in control plane and 100+ plugins; Envoy is a universal C++ proxy that excels as a service mesh data plane but relies on an external control plane to manage configuration.
| Dimension | Apache APISIX | Envoy |
|---|---|---|
| Best for | Full-featured API gateway & Kubernetes ingress | Universal L4/L7 proxy & service mesh data plane |
| Core & runtime | NGINX/OpenResty (LuaJIT) + etcd | C++ proxy + xDS APIs |
| Control plane | ✓ Built-in admin API | External (Envoy Gateway, Istio, Gloo) |
| Plugins / extensibility | 100+ plugins (Lua, Go, Wasm, Python, Java) | C++ filters, Lua filter, Wasm (Proxy-Wasm) |
| Service mesh | North-south focus; APISIX Mesh exists | ✓ Dominant mesh data plane (Istio) |
| API management | ✓ Admin API, routes, consumers | — Needs external control plane |
| License & pricing | Apache-2.0, no paywalled features | Apache-2.0; commercial support via vendors |
What is Apache APISIX?
Apache APISIX is a full-featured, cloud-native API gateway built on NGINX/OpenResty (LuaJIT) with etcd-backed configuration, a built-in admin API, and a 100+ plugin ecosystem — all open-source under Apache-2.0.
Apache APISIX is a full-featured, cloud-native API gateway built on NGINX/OpenResty (LuaJIT) with etcd-backed configuration. It ships a built-in admin API, 100+ open-source plugins for auth, traffic, and observability, and hot configuration reload — all under Apache-2.0 with no paywalled features.
Architecture
NGINX/OpenResty (LuaJIT) + etcd
License
Apache-2.0 (no paywalled features)
Best for
API gateway & Kubernetes ingress
Pros
- Built-in admin API, routes, consumers — no separate control plane to assemble
- 100+ open-source plugins, all included
- Self-reported ~18,000 QPS/core at ~0.2ms added latency
- Custom plugins in Lua, Go, Wasm, Python, Java; hot-loaded at runtime
Cons
- Requires etcd as the configuration store
- Smaller service mesh adoption than Envoy for east-west traffic
- HTTP/3 support is still experimental
- Enterprise dashboard, FIPS, and support come via API7 Enterprise
What is Envoy?
Envoy is a high-performance L4/L7 proxy written in C++, designed as a universal data plane. It is the most widely used service mesh data plane and is configured through xDS APIs served by an external control plane such as Istio or Envoy Gateway.
Envoy is a high-performance L4/L7 proxy written in C++, designed as a universal data plane for modern service-oriented architectures. It is the most widely used service mesh data plane (Istio, Gloo) and is configured statically or dynamically through xDS APIs served by an external control plane.
Architecture
C++ L4/L7 proxy + xDS APIs
License
Apache-2.0 (CNCF project)
Best for
Service mesh data plane
Pros
- C++ performance with a small memory footprint
- Dominant service mesh data plane (Istio, Gloo, App Mesh)
- Dynamic xDS configuration and protocol-aware L4 (Redis, MongoDB, Postgres)
- Strong built-in observability: stats, tracing, access logs
Cons
- No built-in control plane or management UI — needs Envoy Gateway, Istio, or Gloo
- Native filters require C++; a higher barrier than runtime-loaded plugins
- Not a standalone API gateway out of the box
- No built-in developer portal, consumer, or API-lifecycle management
Architecture: API gateway vs universal proxy
APISIX is a batteries-included API gateway with a built-in admin API and etcd-backed config; Envoy is a programmable proxy that depends on an external control plane to become a complete gateway.
Apache APISIX is purpose-built as an API gateway. It runs on NGINX/OpenResty with LuaJIT for plugin execution and stores configuration in etcd, separating a stateless data plane from the control plane. Configuration changes propagate via etcd watch, so routes, plugins, and upstreams update without a restart, and the built-in admin API manages everything out of the box.
Envoy is a general-purpose L4/L7 proxy written in C++ and designed as a universal data plane. It is configured statically or, more commonly, dynamically through xDS APIs — but it does not ship a control plane of its own. It relies on external systems such as Envoy Gateway, Istio, or Gloo Edge to manage configuration. That makes Envoy extremely flexible as a data-plane component, while teams that want gateway functionality out of the box take on more assembly.
Performance
Both are high-performance proxies. Apache APISIX self-reports ~18,000 QPS/core at ~0.2ms added latency; Envoy delivers strong C++ throughput with a small memory footprint. Operational fit usually matters more than peak numbers.
Apache APISIX's official site reports roughly 18,000 QPS per core with about 0.2ms of added latency, attributed to its NGINX event loop and LuaJIT-compiled plugin execution, with etcd config cached locally on each node. Envoy, written in C++ with an asynchronous, event-driven design, also delivers high raw throughput and is described in its own project materials as having a small memory footprint.
An APISIX-authored benchmark found APISIX modestly ahead of Envoy on both QPS and latency for north-south traffic, with the gap widening as worker processes increased. As a vendor benchmark it should be read as directional, not neutral fact — the two are close enough at the raw L4/L7 layer that plugin and filter configuration usually matters more. Benchmark your own workload before deciding.
Apache APISIX vs Envoy: feature comparison
Across architecture, control plane, extensibility, service mesh, and API management, the two trade off a complete gateway against a universal mesh data plane.
| Feature | Apache APISIX | Envoy |
|---|---|---|
| Architecture | NGINX/OpenResty (LuaJIT) with etcd for configuration; stateless data plane with hot config sync | C++ L4/L7 proxy designed as a universal data plane; configured via static files or dynamic xDS |
| Control plane | Built-in: admin API, routes, upstreams, consumers; optional dashboard | None built in; relies on Envoy Gateway, Istio, Gloo Edge, or a custom xDS server |
| Performance | Self-reported ~18,000 QPS/core at ~0.2ms added latency (official benchmark); LuaJIT plugin execution | High raw throughput in C++ with a small memory footprint; event-driven, asynchronous |
| Plugin ecosystem | 100+ open-source plugins — auth, traffic, observability, AI — with no paywalled features | Built-in filters for routing, rate limiting, auth (ext_authz); extend via C++, Lua, or Wasm |
| Custom extensions | Lua (native), Go, Wasm, Python, Java — hot-loaded at runtime without restart | C++ native filters (primary for complex/high-perf), LuaJIT filter, Wasm via Proxy-Wasm (C++/Rust) |
| Dynamic configuration | Hot reload via etcd watch; routes, plugins, upstreams update without restart | xDS APIs (LDS, RDS, CDS, EDS, SDS) stream config from an external control plane |
| Service mesh | North-south focus (gateway, ingress, edge); APISIX Mesh exists but smaller mesh adoption | Dominant data plane for Istio, Gloo, and other meshes; built for east-west sidecar traffic |
| Protocol support | HTTP/1.1, HTTP/2, gRPC, WebSocket, TCP, UDP, MQTT, Dubbo; HTTP/3 experimental | HTTP/1.1, HTTP/2, HTTP/3 (downstream production-ready, upstream alpha), gRPC, TCP, UDP, and protocol-aware Redis, MongoDB, Postgres |
| Security & auth | JWT, OAuth2/OIDC, mTLS, HMAC, API keys, OPA, CORS — built-in plugins | mTLS and JWT natively; richer authN/Z via ext_authz, OPA, or external services |
| Observability | Prometheus, OpenTelemetry, SkyWalking, Zipkin, Datadog — native integrations | Strong telemetry: stats (Prometheus/StatsD), distributed tracing, access logs, admin port |
| Kubernetes | Native Ingress Controller and Gateway API support | Used via Envoy Gateway, Istio, or Contour; not a standalone ingress on its own |
| License & pricing | Apache-2.0; fully open-source with no paywalled features | Apache-2.0; commercial support via Envoy Gateway vendors, Tetrate, Solo.io, or cloud meshes |
When to choose Apache APISIX vs Envoy
Choose Apache APISIX for a complete API gateway and Kubernetes ingress with a built-in control plane; choose Envoy for a universal service mesh data plane managed by Istio, Gloo, or Envoy Gateway.
Choose Apache APISIX if you…
- Need a production-ready API gateway with a built-in admin API and 100+ plugins
- Want OAuth2/OIDC, rate limiting, and transformation without assembling a control plane
- Run Kubernetes ingress, edge, or north-south API management
Choose Envoy if you…
- Building a service mesh and need a universal L4/L7 sidecar data plane
- Already use Istio, Gloo, or another Envoy-based control plane
- Need xDS-driven config or protocol-aware L4 proxying (Redis, MongoDB)
Bottom line: for a service mesh data plane and east-west sidecar traffic, pick Envoy; for a complete API gateway, Kubernetes ingress, and north-south API management without assembling a control plane, pick Apache APISIX — and many teams run both. If you want APISIX's performance with an enterprise dashboard, FIPS 140-2, RBAC, and commercial support, API7 Enterprise is the production-hardened distribution built on Apache APISIX.
Frequently asked questions
Related comparisons
Apache APISIX vs Istio · Apache APISIX vs AWS API Gateway · All gateway comparisons
Ready to get started?
For more information about full API lifecycle management, please contact us to Meet with our API Experts.
