Kong vs Apigee vs Tyk vs APISIX vs KrakenD in 2026

The thing that should decide this comparison is not throughput. Every gateway below routes a request, checks a JWT, and enforces a rate limit, and on any hardware you can afford, all of them are faster than the services behind them. What actually separates them is which parts you get to keep without a contract, and what the meter reads when the month closes.

On both of those, the answers moved in the last eighteen months, and they moved in a direction that makes the usual recommendation wrong.

Kong’s open source edition stopped shipping features

The Kong/kong repository’s newest release is 3.9.3, published 17 June 2026. It is a patch on 3.9.0, which shipped in December 2024. Meanwhile Kong Gateway Enterprise is on 3.15.0.4, dated 20 August 2026, and the Kong changelog is explicitly labeled as covering supported Enterprise versions.

The gap is not an accident of release timing. From 3.10 onward, the Enterprise image dropped its free mode: run kong/kong-gateway:3.10 or later without a valid license and it behaves as an expired Enterprise install, not as a full OSS gateway. Kong staff confirmed this in a repository discussion, and the guidance there is to pin kong:3.9.1 if you want to stay on free builds.

So “use Kong OSS and upgrade to Enterprise later if we need it” is no longer a plan with a middle. You are choosing a gateway that is six minor versions behind and receiving patches, or you are a customer. I would not build a new platform on the free build in that state. Existing 3.9 clusters are fine and will keep getting fixes, but treat the version as a ceiling rather than a starting point.

The per-request rates are not close to each other

Both Kong and Google publish list prices, which makes this checkable rather than a matter of anecdote. I pulled these off the vendor pages on 21 August 2026.

Kong Konnect Plus charges per control plane per month: $25 serverless, $200 hybrid, $500 dedicated cloud. One million API requests are included. Every additional million is $200/month, and the plan caps out at 10 million requests per month, after which you are into an Enterprise quote. Advanced analytics covers the first million and then bills $20 per additional million. AI Gateway includes five models, then $100/month per model.

Apigee’s pay-as-you-go rates are $20 per million standard proxy calls up to 50 million, dropping to $16 and then $13 at higher volumes. Proxies that run JavaScript, Python, or Java callouts are billed as extensible calls at $100 per million. On top of the calls you pay for an environment: $0.50 per hour for Base, $2.00 for Intermediate, $4.70 for Comprehensive, per region. Base works out to roughly $365 a month.

Run that out. At one million requests a month on a hybrid control plane, Konnect Plus is $200 and Apigee is about $385. Apigee looks worse. At ten million, Konnect Plus is $2,000 before analytics and Apigee is about $565. At fifty million, Konnect Plus is not an option at all and Apigee is around $1,365.

That inversion is the single most useful thing in this post, and it is the opposite of the received wisdom that Kong is the affordable one and Apigee is the enterprise tax. The received wisdom was formed when Kong’s free build was a real product.

APISIX

Apache 2.0, currently on 3.18.0 as of 20 August 2026, and shipping steadily. It stores configuration in etcd rather than Postgres, which means one fewer stateful service and config changes that propagate without a restart cycle. The plugin set is not tiered: OIDC with claims mapping and the rate-limit algorithm you actually wanted are in the same build as everything else.

This is where I would start a new deployment. Not because of a benchmark. Because the license does not have a trap door in it, and because the project is still releasing minor versions.

Two honest weaknesses. The documentation has a translation seam in places and you will occasionally end up reading a GitHub issue instead. And if your team has no Lua on the bench, custom plugins are more friction than the marketing suggests, though the external plugin runners take some of that edge off.

On performance: APISIX publishes a benchmark run with wrk on a Google Cloud n1-highcpu-8 with four cores given to the gateway. The numbers live in the charts rather than the prose, and they are the vendor’s own run. Every gateway in this post publishes a benchmark it won. Treat all of them as a filter, not a decision.

KrakenD

A stateless Go binary that reads JSON config and talks to no database. It is not trying to be an API management platform, and teams dismiss it early for that reason.

What it does well is aggregation: compose four backend calls into one response, validate the token, apply the limits, emit metrics. KrakenD’s own benchmarks top out at about 18,000 requests per second. The machine that produced that number is a 2015 MacBook Pro, and their EC2 results run lower. The interesting property is not the number but the shape: no control plane, no etcd, no Postgres, nothing to be down at 2 AM.

Pick it if your gateway is doing backend-for-frontend work. Do not pick it if you need a developer portal or two hundred teams self-serving routes.

Tyk

Licensed MPL 2.0, on 5.14.0 as of July 2026. It sits in a real gap: you get a dashboard, key management, and analytics without assembling them yourself on top of a bare proxy. The developer portal and the advanced analytics are the commercial pieces.

MPL is more restrictive than Apache 2.0 in one specific way that matters little to most teams and a lot to a few: modifications to Tyk’s own files have to be published under the same license. Combining it with proprietary code in separate files is fine.

The cost is community size. The plugin set is smaller and the search results run thinner when you hit an edge. Budget engineering time for middleware you would have found prewritten elsewhere.

Apigee

Dense, capable, and now the cheapest per-request option in this post at any real volume, which is a sentence I did not expect to write. Full lifecycle management, a developer portal, monetization, and analytics that product managers use without being asked twice.

The catch is the environment floor and the extensible-call multiplier. A proxy with a JavaScript callout costs five times a plain one. If you write policy logic the easy way, your bill is a different product than the one you priced.

If Apigee is already in your stack, the migration math rarely favors leaving. If it is not, and you are on Google Cloud anyway, it now deserves a real look on cost grounds rather than only on compliance grounds.

The rest of the shortlist

Traefik is the answer if your gateway is mostly Kubernetes ingress with a few middlewares. Envoy is a proxy rather than a gateway, and you will meet it as the data plane inside a service mesh, at which point your mesh’s ingress gateway already covers much of this.

The cloud-native options are fine when you have committed to one cloud. AWS API Gateway’s HTTP APIs run about $1 per million requests at the first tier, which undercuts everything here, and the lock-in is exactly as real as it sounds.

Putting an LLM gateway behind this one

Every gateway now ships an AI traffic story. Kong charges $100 per month per model past the first five on Konnect Plus, which prices the feature honestly at least.

For most teams the answer is still a dedicated LLM gateway in front of the model providers and your normal gateway in front of that. I went through the options for that layer in a separate post on LLM gateways. Collapsing both jobs into one product is appealing on a slide and awkward the first time you need a per-model quota that your API gateway’s config language cannot express.

Where I would land

New platform, no incumbent: APISIX. Aggregation-shaped gateway with a small team: KrakenD. Want a dashboard without building one: Tyk. Already on Google Cloud with volume: Apigee, on the numbers above.

Kong is now a purchase decision rather than a default. That is a fair thing for a company to do with its own software, and the product is good. It just means the honest version of “should we use Kong” is “can we sign for it,” and a lot of teams answering that question have been answering the old one.

Before you sign anything, put a week of your real traffic through the top two with your actual auth chain attached. The published rates tell you what a million requests cost. They do not tell you how many requests your rate-limit rules turn into.