API gateways in 2026: Kong Gateway vs Tyk vs Apache APISIX vs KrakenD vs Envoy Gateway

An API gateway becomes part of the request path, so choosing one is an operating decision as much as a feature comparison. Routing, authentication, traffic limits, transformations, and telemetry must continue to behave predictably during configuration changes, dependency failures, and upgrades. A long plugin list is useful only if the team can support the resulting system.

Kong Gateway, Tyk, Apache APISIX, KrakenD, and Envoy Gateway approach that responsibility differently. This guide uses official product, deployment, and pricing sources reviewed on October 20, 2026. It compares architectural fit and commercial boundaries without claiming measured throughput, security certification, or hands-on testing.

Define the gateway’s responsibility

Decide whether you need request enforcement, response aggregation, developer onboarding, commercial API management, or several of these together. A reverse proxy data plane and a developer portal are different components. A gateway also cannot replace application authorization: accepting a valid token does not establish that its owner may access every requested record.

Keep this decision distinct from message broker selection. Gateways manage request traffic and policy at an API boundary; asynchronous transport, replay, and consumer coordination involve different contracts. Protocol support must be checked for the specific deployment and edition rather than inferred from a product family’s marketing.

The quick difference

Product	Best-fit starting point	Operating model	Main boundary
Kong Gateway	Plugin-driven gateway with commercial management paths	Traditional, hybrid, or DB-less topologies	OSS, Enterprise, Konnect, and hosted resources differ
Tyk	Gateway plus a broader API management platform	Open-source, self-managed, cloud, and hybrid options	Dashboard and governance are not the entire OSS gateway
Apache APISIX	Dynamic routing with an open-source plugin ecosystem	Control/data-plane and standalone deployment choices	Configuration storage and mode affect operations
KrakenD	Declarative API composition and aggregation	Configured gateway endpoints and backends	Community and Enterprise capabilities differ
Envoy Gateway	Gateway API-centered platform engineering	Control plane managing Envoy Proxy instances	Policy extensions and dependent services need ownership

Kong Gateway

Kong Gateway routes API traffic and adds behavior through plugins. Its documentation distinguishes traditional, hybrid, and DB-less deployments, while Konnect provides commercial control-plane and gateway management options. This flexibility makes it relevant when applications span infrastructure boundaries and platform teams want reusable policies rather than per-application proxy configuration.

Strength: a defined gateway entity model and plugin ecosystem support a broad set of routing and policy requirements. Limitation: a plugin’s existence does not mean it is included in every edition or behaves identically in every topology. Confirm the exact authentication, rate-limiting, and configuration features against the intended deployment.

The current Konnect API Management page advertises Plus from US$25 monthly plus usage, with Enterprise custom-priced and billed annually. The rate card separates control planes, transaction volume, and other resources; dedicated cloud gateways have additional control-plane and bandwidth charges. Do not present the entry figure as an all-inclusive gateway bill. Include self-hosted data-plane compute, and request a quote for required governance and support. Open-source use is a separate scope from that commercial package.

Tyk

Tyk distinguishes its open-source gateway from proprietary platform components. The deployment documentation lists rate limiting and authentication in the gateway, while dashboard, developer portal, team governance, and other management functions belong to broader offerings. It supports several deployment arrangements rather than requiring every buyer to place the full system in a vendor-managed cloud.

Strength: teams can evaluate request enforcement and the wider API lifecycle as related but separately scoped needs. Limitation: buying only the gateway does not supply every workflow shown in a full-platform demonstration. Document which components store configuration and analytics and which party operates each dependency.

Current commercial packaging names Core, Professional, and Enterprise. Core is usage-based; Professional is presented as flat-rate with unlimited APIs and requests; Enterprise adds a tailored scope. Public pricing requires contact rather than providing a comparable numeric rate. Confirm currency, annual or monthly commitments, support, deployment rights, and the meaning of unlimited within the agreement. The free open-source gateway and the time-limited cloud trial should not be described as equivalent offers.

Apache APISIX

Apache APISIX is an open-source gateway with dynamic routing and plugin-based traffic controls. Its documentation separates deployment modes, including configurations with control and data planes and standalone arrangements. That matters because the architecture behind a simple local demonstration may differ from the configuration distribution and storage model used in production.

Strength: open-source configuration and extension mechanisms give infrastructure teams room to integrate traffic policy with their own platform. Limitation: flexibility creates an obligation to understand dependencies, administrative access, configuration validation, and failure recovery. A team should not treat a quickstart’s exposed management interfaces as an acceptable production design.

Confirm whether the chosen mode uses etcd or another supported configuration path, and rehearse changes while a dependency is unavailable. The Apache project does not impose a commercial subscription price for its open-source software. Compute, configuration storage, monitoring, upgrades, and any separate vendor support remain costs. Review compatibility of required plugins and policies before estimating migration effort from another gateway; similarly named features may have different semantics.

KrakenD

KrakenD is useful to examine when the gateway must compose an outward-facing API from several backend responses. Its configuration model describes public endpoints and backend services, with request/response manipulation and forwarding controls. That emphasis can fit a backend-for-frontend boundary where callers should not orchestrate every internal service interaction themselves.

Strength: deliberate endpoint composition encourages teams to define the contract exposed to clients. Limitation: aggregation also creates difficult decisions about partial failures, timeouts, missing data, and cache behavior. Combining responses in one place does not remove the need to design those contracts.

Compare Community and Enterprise against the exact required capabilities. The Enterprise page presents commercial licensing and support from the product’s developers, but it does not provide a universal public numeric quote for this evaluation. Obtain the deployment allowance, currency, term, support coverage, and upgrade conditions in writing. Include any plugins and external services in the operating design, and check whether a transformation belongs in the gateway or should remain tested application logic.

Envoy Gateway

Envoy Gateway manages Envoy Proxy through a dedicated control plane. Its documentation centers on Kubernetes Gateway API resources and additional policy APIs, with standalone deployment also documented. This makes it especially relevant when a platform team wants traffic configuration to follow the same declarative resource model used elsewhere in its infrastructure.

Strength: a clear distinction between declared resources, the controller, and the Envoy data plane helps assign responsibilities. Limitation: standard resources do not cover every advanced requirement. Product-specific policies and extensions can still create migration work, so verify actual support rather than assuming complete portability from a shared API name.

The project is open source, with infrastructure and support costs borne separately. Features can introduce dependencies: the documented global rate-limit architecture includes a rate-limit service and a Redis instance supplied by the operator. Confirm release compatibility, upgrade behavior, and how application teams receive useful configuration errors. Envoy Gateway is not simply a different name for a raw Envoy configuration file or an automatically included commercial API management suite.

How to evaluate the shortlist

Write an explicit policy contract. Specify token validation, record-level authorization boundaries, request size, timeouts, retry behavior, rate-limit identity, and forwarded headers. Include long-lived connections if relevant. Test the contract with a small real API before migrating the full catalog.

Rehearse a bad change. Check how invalid configuration is rejected, which prior state remains active, and how operators identify an affected route. Exercise dependency failure and recovery as well as the happy path. A management interface should not be reachable simply because the public proxy must be.

Price the topology. Count regions, control planes, data planes, traffic, analytics retention, and support. For open-source systems, include dependent databases and engineering ownership. For commercial systems, compare the required deployment and governance scope rather than a promotional starting price in a different currency.

Conclusion

Kong Gateway and Tyk deserve attention when broader commercial API management paths matter. APISIX fits teams prepared to operate an open-source policy platform, KrakenD emphasizes explicit API composition, and Envoy Gateway aligns closely with Gateway API-based infrastructure. Choose the request contract and operational model first; feature breadth becomes useful after those foundations are clear.

References

Official sources reviewed on October 20, 2026. Plan allowances and prices can change; confirm the selected billing currency, commitment, deployment, and included services before purchase.