Top 11 API Gateways Compared (2026)
By API7.ai Team
Last updated: October 16, 2026
Choose an API gateway by deployment ownership, governance, and measured workload performance. Shortlist API7 Enterprise for self-hosted enterprise management of an APISIX-based runtime; Apache APISIX for independent open-source operation; and cloud-managed gateways when provider ownership is preferred. This guide compares eleven gateways and explains where a commercial management layer changes the decision.
For enterprise Kubernetes, multi-cloud, or on-premises fleets needing an APISIX-based gateway plus centralized governance and commercial support, evaluate API7 Enterprise. Choose Apache APISIX independently when open-source operation is the requirement. Prefer a provider-operated service when minimizing runtime operations matters more than self-hosting. Keep the eleven-product shortlist below separate from the decision to buy a commercial management layer.
- Self-hosted enterprise governance for an APISIX-based runtime: API7 Enterprise
- A fast, fully open-source, self-hosted gateway: Apache APISIX
- A mature ecosystem + managed SaaS: Kong
- Serverless APIs on AWS: Amazon API Gateway
- Enterprise API programs on Google Cloud: Google Apigee
- Kubernetes-native Envoy + Gateway API: Solo.io Gloo Gateway
Top 11 API gateways at a glance
A quick comparison by type, open-source scope, and best fit. The list below is not a strict ranking — the right gateway depends on your environment and constraints.
| Dimension | Type | License | Best for |
|---|---|---|---|
| Apache APISIX | Self-hosted OSS (independent ASF project) | ✓ Apache-2.0 (ASF project) | A fast, fully open-source gateway |
| Kong Gateway | Self-managed + Konnect SaaS | Apache-2.0 core + Enterprise | Mature ecosystem + managed SaaS |
| Amazon API Gateway | Managed SaaS (AWS only) | Proprietary | Serverless APIs on AWS |
| Google Apigee | Managed SaaS (+ hybrid runtime) | Proprietary | Enterprise API programs on GCP |
| Tyk | OSS Gateway + licensed platform | ✓ MPL-2.0 (gateway) | Go gateway + optional commercial stack |
| Solo.io Gloo Gateway | Kubernetes-native (OSS + Enterprise) | Apache-2.0 core (kgateway) | Kubernetes + Gateway API teams |
| MuleSoft Anypoint | Managed + self-managed Omni Gateway | Mule core CPAL; platform commercial | Integration + API management |
| Gravitee | OSS CE + Enterprise/Cloud | ✓ Apache-2.0 (core) | Event-driven APIs alongside REST |
| Boomi API Management | SaaS control plane + distributed runtimes | Proprietary | API governance on the Boomi iPaaS |
| Layer7 API Gateway | Enterprise self-hosted (on-prem/hybrid) | Proprietary | Regulated, on-prem enterprises |
| Alibaba Cloud API Gateway | Cloud-native managed service | Proprietary | APIs on Alibaba Cloud (China/APAC) |
Choose by operating model
Start with the operating boundary your team can support. A product may appear in more than one group because editions and deployment modes assign responsibilities differently.
Open-source self-hosted
For teams that need runtime control and can own upgrades, scaling, security operations, and observability.
Examples: Apache APISIX, Kong Gateway OSS, Tyk Gateway, kgateway
Managed cloud service
For teams that prefer provider-operated gateway infrastructure and accept a cloud-specific service boundary.
Examples: Amazon API Gateway, Google Apigee, MuleSoft Managed Omni Gateway, Alibaba Cloud API Gateway
Enterprise or hybrid platform
For organizations that need centralized governance while retaining some or all data planes in their environments.
Examples: API7 Enterprise, Kong Konnect, Apigee hybrid, Tyk, MuleSoft, Gravitee, Boomi, Layer7
Kubernetes-native
For platform teams that want Kubernetes resources and Gateway API to be the primary configuration interface.
Examples: kgateway, Gloo Gateway, Apache APISIX Ingress Controller, Kong Ingress Controller
When should API7 Enterprise enter your shortlist?
Shortlist API7 Enterprise when you want an APISIX-based gateway on infrastructure you control, but need centralized administration, gateway groups, RBAC, audit logs, and commercial support. It is a commercial option, not a replacement name for Apache APISIX.
API7.ai is the company publishing this guide. Apache APISIX is an independent Apache Software Foundation project. API7 Enterprise is API7.ai’s commercial offering; its implementation documentation uses the name API7 Gateway. Buying Enterprise adds a commercial management layer rather than changing the ownership or license of Apache APISIX. The eleven gateway entries and their existing anchors remain below.
A fit when
Your platform team needs governed configuration across regions or Kubernetes clusters, must place traffic nodes on-premises or in chosen clouds, and can operate the self-hosted control plane and database. Validate role scopes, identity integration, and release promotion with a representative API.
Not the default when
You only need an open-source proxy, cannot operate production infrastructure, or require the provider to manage the entire runtime. An Enterprise license is not an automatic availability or compliance guarantee; confirm the contracted support scope.
API7 Enterprise evidence, checked October 16, 2026 against API7 Gateway 3.10.x: the architecture separates customer-operated control and data planes, with a relational management database and DP Manager distributing configuration. The Enterprise feature guide documents governance boundaries; the Kubernetes deployment guide covers installation. Review the support policy separately from runtime availability requirements.
Evaluate API7 Enterprise or compare its management model with Kong, Tyk, Gravitee, and WSO2 in the Top 5 API management platforms guide.
How to choose an enterprise API gateway for Kubernetes
Compare the configuration authority and operating boundary, not only the Helm installation. A gateway running on Kubernetes is not automatically a conformant Kubernetes Gateway API controller, a multi-cluster management platform, or a provider-operated service.
On a small screen, scroll the table horizontally to compare all columns.
| Dimension | API7 Enterprise / API7 Gateway | Apache APISIX (open source) | Kong (topology-dependent) |
|---|---|---|---|
| Configuration entry point | Dashboard and Admin API for API7 Gateway; validate your automation workflow. | APISIX Admin API or its Ingress Controller for Kubernetes resources; select a configuration authority. | Choose Kong controller or hybrid/Konnect management deliberately; do not assume both own the same configuration. |
| Multiple clusters and regions | Gateway groups organize separate environments and runtime fleets. | Design cluster isolation, configuration promotion, and cross-cluster automation. | Choose the controller, control-plane, and data-plane grouping appropriate to the selected deployment. |
| Governance | Commercial RBAC, SSO, and audit logs; test administrative scopes. | Review project capabilities and build or integrate missing organizational workflows. | Verify Enterprise or Konnect entitlements and management scopes. |
| Observability | Built-in monitoring and documented metrics/tracing integration; validate collection and retention. | Configure gateway plugins, collectors, dashboards, retention, and alerts. | Verify runtime telemetry, analytics plan, and any provider-side data transfer. |
| Operational responsibility | Customer operates self-hosted CP, database, DP, network, upgrades, and recovery. | Customer operates the gateway and its chosen storage/controller topology. | Self-managed runtime remains customer-operated; a managed CP does not automatically include a managed DP. |
| Support and fit | Fit: paid governance and product support. Not fit: an OSS-only requirement or an assumed fully managed runtime. | Fit: open-source control with engineering ownership. Community support is not a contracted response target. | Fit: Kong ecosystem or hosted management. Confirm support scope and edition costs. |
For high-throughput selection, record gateway and plugin versions, CPU allocation, TLS, payloads, authentication, rate limiting, logging, and upstream behavior. Measure sustained throughput, tail latency, errors, and resource use with the same workload. The API7 Gateway benchmark methodology and reproducible assets distinguish a mocking-only ceiling from actual upstream proxying; neither establishes that API7 is universally fastest.
For on-premises and hybrid deployments, test outbound management connectivity, certificate rotation, control-plane loss, and a cold start without the control plane. Existing API7 nodes can continue with in-memory configuration; restarting nodes need the control plane or an explicitly configured fallback. Review data-plane resilience and the hybrid and multi-cloud architecture guide before treating management-plane separation as a recovery guarantee.
How we evaluated
This guide is published by API7, the company behind API7 Enterprise and the original creators of Apache APISIX. We include Apache APISIX honestly alongside competitors — each entry lists real strengths and honest limitations, and facts about other products are drawn from their official documentation.
- Open-source scope and license
- Performance and architecture
- Plugin and extensibility model
- Deployment: self-host, cloud, hybrid, or managed
- Protocol and API-type support
- Governance, security, and ecosystem
The 11 API gateways
1. Apache APISIX
The fully open-source, dynamic, high-performance API gateway
Type
Self-hosted OSS (+ API7 Enterprise)
License
Apache-2.0 (ASF top-level project)
Best for
A fast, fully open-source gateway
Disclosure: Apache APISIX was created by API7, which publishes this page, and donated to the Apache Software Foundation. It is an Apache-2.0 API gateway built on NGINX and LuaJIT, with etcd-backed dynamic configuration and an open-source plugin ecosystem.
Key features
- Dynamic route and plugin configuration backed by etcd, without an NGINX reload for routine updates
- Open-source plugins for authentication, traffic control, observability, transformation, and AI traffic
- HTTP, gRPC, WebSocket, and stream-proxy use cases, subject to protocol-specific configuration
- Admin API, declarative configuration, service discovery integrations, and Kubernetes ingress support
Where others may still be better: You install, upgrade, and operate it yourself, and the community edition has no console RBAC, audit, or SLA. For those, API7 Enterprise (commercial) or a managed cloud gateway may fit better.
Best fit: Teams that want a fast, dynamic, fully open-source gateway they can self-operate — with a commercial upgrade path via API7 Enterprise.
Official sources: APISIX documentation · Plugin Hub
2. Kong Gateway
A mature, widely adopted gateway with a large plugin ecosystem
Type
Self-managed + Konnect SaaS
License
Apache-2.0 core + commercial Enterprise
Best for
Mature ecosystem + managed SaaS
Kong Gateway is an open-source API gateway on NGINX/OpenResty, backed by PostgreSQL or run DB-less, with a large Plugin Hub. Kong Inc. adds Kong Enterprise and the managed Kong Konnect platform on top of the open-source core.
Key features
- Open-source Kong Gateway core (Apache-2.0), governed by Kong Inc.
- Large Kong Plugin Hub (100+ plugins including partner and third-party)
- Deployment modes: traditional (PostgreSQL), DB-less, and hybrid CP/DP
- Managed Kong Konnect SaaS; Kong AI Gateway plugins for LLM traffic
Where others may still be better: Feature availability differs between Kong Gateway OSS, Kong Gateway Enterprise, and Konnect. Teams should map every required plugin and management feature to the intended edition before choosing a topology.
Best fit: Teams wanting a mature ecosystem and a managed SaaS control plane, comfortable adopting Kong Enterprise for advanced features.
Official sources: Deployment topologies
3. Amazon API Gateway
A fully managed, serverless gateway tightly integrated with AWS
Type
Managed SaaS (AWS only)
License
Proprietary AWS service
Best for
Serverless/Lambda backends on AWS
Amazon API Gateway is a fully managed AWS service for creating REST, HTTP, and WebSocket APIs at any scale. It handles traffic management, authorization, throttling, and monitoring, and acts as a front door to backends like AWS Lambda — with no servers to run.
Key features
- REST, HTTP, and WebSocket API types with different feature and pricing models
- Authorization via IAM, Lambda authorizers, and Amazon Cognito
- Deep AWS integration: CloudWatch, CloudTrail, AWS WAF, X-Ray, CloudFront, CloudFormation
- Provider-operated scaling with usage-based pricing, custom domains, and deployment controls
Where others may still be better: It runs only on AWS — no self-hosting or multi-cloud — and is a gateway, not a full API-productization or monetization platform. REST APIs also cost more than the leaner HTTP APIs.
Best fit: Teams already on AWS building serverless or Lambda-fronted backends that want a provider-operated, usage-priced gateway.
Official sources: Amazon API Gateway guide
4. Google Apigee
A full-lifecycle enterprise API management platform on Google Cloud
Type
Managed SaaS (+ hybrid runtime)
License
Proprietary Google Cloud product
Best for
Enterprise API programs on Google Cloud
Apigee is Google Cloud’s API management platform for developing, securing, deploying, and scaling APIs. It offers API proxy management, traffic and security policies, a developer portal, analytics, and monetization — delivered fully managed (Apigee X) or as a hybrid model with a customer-run Kubernetes runtime.
Key features
- API proxy management with standard and extensible proxies
- Hybrid runtime: Google-hosted control plane plus a customer-run Kubernetes data plane
- Developer portal, analytics, and API monetization
- Enterprise controls: data residency and customer-managed encryption keys (CMEK)
Where others may still be better: It is a full enterprise platform, not a lightweight or free gateway; the control plane is always Google-hosted (no air-gap), and the hybrid runtime pushes Kubernetes and Cassandra operations onto you. Cost modeling is complex.
Best fit: Large enterprises on Google Cloud needing full lifecycle management, productization, and monetization — not just a proxy.
Official sources: Apigee feature summary · Apigee hybrid overview
5. Tyk
An open-source Go gateway with licensed management, Enterprise streaming, and separately packaged AI options
Type
OSS Gateway + licensed platform
License
MPL-2.0 Gateway + licensed components
Best for
Go gateway + optional commercial stack
Tyk Gateway is an open-source (MPL-2.0), Go-based API gateway that runs on Redis. Tyk Dashboard, Developer Portal, Multi Data Center Bridge, Universal Data Graph, Operator, and Sync are proprietary components that require licenses for on-premises deployment. Tyk Streams is an Enterprise Gateway capability, while Tyk AI Studio is a separate product with Community and Enterprise editions.
Key features
- Open-source Tyk Gateway: REST, GraphQL proxying, TCP, and gRPC on a lightweight Redis runtime
- Polyglot plugins: Go, gRPC (any language), JavaScript, Python, Lua
- Licensed platform: Dashboard, Developer Portal, Multi Data Center Bridge, and Universal Data Graph
- Enterprise Gateway: Tyk Streams for Kafka, WebSocket, SSE, and other event-driven APIs
- Separate AI product: Tyk AI Studio has Community and Enterprise editions
- MCP Gateway: remote MCP proxying is available on all Gateway licenses; upstream OAuth, token exchange, and REST API-to-MCP proxying require Enterprise
Where others may still be better: The open-source gateway and the commercial management platform have different feature and infrastructure boundaries. Dashboard-managed deployments add a management datastore, so evaluate the complete topology rather than the gateway binary alone.
Best fit: Teams wanting an open-source Go gateway that can add licensed API management and streaming or adopt the separately packaged AI Studio product as requirements grow.
Official sources: Tyk API management docs · Tyk Stack licensing · Tyk Streams availability · Tyk AI Studio editions · Tyk MCP Gateway editions
6. Solo.io Gloo Gateway
Kubernetes-native gateway products built around Envoy and Gateway API
Type
Kubernetes-native (OSS + Enterprise)
License
Apache-2.0 core (kgateway)
Best for
Kubernetes + Gateway API teams
Solo.io offers commercial Gloo Gateway and Solo Enterprise for kgateway products for Kubernetes environments. The related open-source kgateway project is a CNCF project built on Envoy and the Kubernetes Gateway API. Product names, versions, and enterprise feature sets should be checked separately.
Key features
- Kubernetes Gateway API configuration translated to Envoy data-plane configuration
- Traffic management: retries, timeouts, health checks, and transformations
- Open-source routing, resiliency, security, and observability capabilities in kgateway
- Additional management, support, security, and multicluster capabilities in commercial editions
Where others may still be better: The product family is Kubernetes-centered, and similarly named Gloo Gateway, kgateway, and Solo Enterprise offerings have different release trains and license boundaries. Confirm the exact product and edition before comparing features.
Best fit: Platform and DevOps teams standardized on Kubernetes and the Gateway API who want an Envoy gateway and will buy enterprise features for advanced use.
Official sources: kgateway documentation · Gloo Gateway overview
7. MuleSoft Anypoint
A unified iPaaS and full-lifecycle API management platform (Salesforce)
Type
Managed + self-managed Omni Gateway
License
Mule core CPAL; platform commercial
Best for
Integration + API management in one
MuleSoft Anypoint Platform combines integration and API management. API Manager provides management capabilities, while Omni Gateway, renamed from Flex Gateway in 2026, is an Envoy-based runtime available as a MuleSoft-managed deployment on CloudHub 2.0 or Runtime Fabric and as a self-managed deployment in customer infrastructure.
Key features
- Managed Omni Gateway on CloudHub 2.0 or Runtime Fabric, or self-managed deployment on Linux, containers, Kubernetes, and OpenShift
- Connected and Local modes for different self-managed control-plane workflows
- Prebuilt policies: OAuth2, IP allow/deny, rate limiting, and SLA-based tiers
- iPaaS breadth: hundreds of prebuilt connectors to apps and systems
Where others may still be better: It is an enterprise integration suite — heavier and more complex than a standalone gateway; only the Mule runtime core is open source (CPAL), and pricing is sales-led with no public list.
Best fit: Large enterprises (especially Salesforce customers) needing integration plus API management across many systems, not just an edge gateway.
Official sources: Omni Gateway overview · Gateway release notes
8. Gravitee
Event-native API management for REST and async (Kafka/MQTT)
Type
OSS Community Edition + Enterprise/Cloud
License
Apache-2.0 core + commercial Enterprise
Best for
Event-driven APIs alongside REST
Gravitee is an open-source (Apache-2.0) API management platform that treats event-driven and async protocols — Kafka, MQTT, WebSocket — as first-class alongside REST, with a companion Access Management product. It is self-hostable as the Community Edition or run via the managed Gravitee Cloud.
Key features
- Full API lifecycle: design, publish, document, discover, secure, and analytics
- Event-native async APIs — Kafka, MQTT, RabbitMQ, Solace, WebSocket (Enterprise Edition)
- Companion Access Management; Dynamic Client Registration and OIDC SSO (Enterprise)
- Self-hosted Community Edition (Apache-2.0) or managed Gravitee Cloud
Where others may still be better: The headline event-native/async capability is Enterprise-gated — the free Community Edition is REST-centric, and enterprise observability, secrets, and multi-environment management require a license.
Best fit: Organizations managing event-driven and async APIs (Kafka/MQTT) alongside REST that want combined API management and access management.
Official sources: Gravitee APIM overview
9. Boomi API Management
Integration-native API management inside the Boomi iPaaS
Type
SaaS control plane + distributed runtimes
License
Proprietary
Best for
API governance on the Boomi platform
Boomi API Management is a module of the Boomi Enterprise Platform (iPaaS). It lets teams expose versioned REST, SOAP, and OData APIs and then secure, route, and monitor them through an API Gateway and Developer Portal, with low-code design tied to Boomi integrations.
Key features
- API Gateway providing a single entry point for security, traffic management, and observability
- Versioned API lifecycle with auto-generated OpenAPI and WSDL specs
- Policy management (quotas, rate limits), API discovery, and security scoring
- Developer Portal and real-time API analytics
Where others may still be better: It is a module within the broader Boomi platform rather than an independent open-source gateway. Teams should verify runtime placement, platform dependencies, and contract terms for their planned topology.
Best fit: Organizations already on Boomi iPaaS that want to expose and govern their integrations as managed APIs with low-code effort.
Official sources: Boomi API Gateway
10. Layer7 API Gateway
A security-hardened enterprise gateway for regulated industries (Broadcom)
Type
Enterprise self-hosted (on-prem/hybrid)
License
Proprietary (Broadcom)
Best for
Regulated, on-prem enterprises
Layer7 API Gateway is Broadcom’s enterprise API gateway (formerly CA API Gateway). It enforces authentication, authorization, threat protection, message validation, transformation, and routing at a central policy point, deployable as a software install, appliance, virtual appliance, or a containerized Container Gateway on Kubernetes.
Key features
- Runtime policy enforcement: authentication, authorization, key management, integrity
- Threat protection, message validation, transformation, and routing policies
- Visual policy management with enterprise identity and PKI integrations
- Software and container deployment options for customer-operated environments
Where others may still be better: It is heavyweight to operate — customer-run infrastructure plus a MySQL database, with strong SOAP/XML heritage. The Developer Portal is a separate component with its own deployment and entitlement considerations; confirm packaging and pricing with Broadcom.
Best fit: Large, regulated enterprises (finance, government, healthcare) needing a security-hardened, on-prem/hybrid gateway that integrates with existing PKI and identity.
Official sources: Layer7 API Gateway · Layer7 Developer Portal
11. Alibaba Cloud API Gateway
Alibaba Cloud’s current cloud-native managed API gateway
Type
Cloud-native managed service
License
Proprietary
Best for
APIs on Alibaba Cloud (China/APAC)
Alibaba Cloud Cloud-native API Gateway is the provider’s current managed gateway for API, route, and ingress management. Alibaba Cloud has announced the retirement of its Traditional API Gateway and MSE Cloud-native Gateway, with migration to the unified Cloud-native API Gateway required before final shutdown.
Key features
- Managed API, route, and ingress configuration within Alibaba Cloud
- Authentication, authorization, throttling, and traffic-management controls
- Cloud-native architecture integrating gateway and Kubernetes ingress workflows
- Migration paths for existing Traditional API Gateway deployments
Where others may still be better: It is tied to Alibaba Cloud and is not self-hostable. Existing Traditional API Gateway users also need to assess feature differences and complete a migration before the announced service shutdown.
Best fit: Teams building on Alibaba Cloud — especially in China and APAC — needing a managed, scalable gateway integrated with Alibaba Cloud services.
Official sources: Cloud-native API Gateway · Traditional gateway retirement
Frequently asked questions
Related comparisons
Top 5 API management platforms · Apache APISIX vs Kong · All gateway comparisons
Ready to get started?
For more information about full API lifecycle management, please contact us to Meet with our API Experts.
