Every team running production LLM traffic in September 2026 eventually hits the same wall: API keys scattered across services, no shared cache, no fallback when OpenAI throttles a region, and a finance team asking why the model bill tripled. The fix has a name now — the AI gateway — and three products keep coming up in the same breath: Cloudflare AI Gateway, Portkey, and Kong AI Gateway. Search interest in “ai gateway” as a category has climbed into the thousands of monthly queries, and for good reason: this is the layer that sits between an app and every model provider it calls, handling caching, rate limits, cost tracking, fallback routing, and guardrails in one place.
This comparison breaks down how the three approach the problem differently. Cloudflare built its gateway as a free add-on to an edge network that already touches a huge share of the internet’s traffic. Portkey started as an AI-native startup and went further into open source in March 2026. Kong took its existing API management business, the one already compared in a Kong vs AWS API Gateway vs Apigee breakdown on this site, and bolted AI-specific routing and governance onto Konnect. None of the three chase the same buyer, and the pricing gap between a hobbyist project and a mid-size enterprise deployment can run from $0 to well over $50,000 a year.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What an AI Gateway Actually Does
An AI gateway is a proxy layer that intercepts calls to OpenAI, Anthropic, Gemini, Bedrock, and other model providers, then applies policy before the request ever leaves the network. That means semantic or exact-match caching to avoid paying twice for an identical prompt, rate limiting to stop a single misbehaving service from blowing through a quota, automatic fallback when a provider returns an error or times out, per-team and per-model cost attribution, and guardrails that block unsafe content or enforce PII redaction before a response reaches a user.
The category exists because token spend stopped being a rounding error. Engineering teams that once ran a single OpenAI key now juggle five or six providers for redundancy and cost arbitrage, and finance teams want the same kind of spend visibility they already get from a cloud FinOps dashboard. That pressure is the same one driving demand for FinOps tooling more broadly — a trend covered in depth in our piece on cloud waste hitting 29% of spend as AI budgets get squeezed. An AI gateway is, in effect, FinOps for tokens instead of instances.
Shadow AI adds a second driver. When developers wire an API key directly into a script, security and compliance teams lose visibility into what data left the building and which model saw it. Routing every call through a gateway gives a single point to log, redact, and audit — a governance model that mirrors what identity-aware policies already do for east-west network traffic.
A third, quieter driver is provider risk. Model providers change pricing, deprecate endpoints, and occasionally suffer outages, and any application calling a provider directly inherits that instability with no buffer. A gateway with fallback routing configured turns a provider outage into a brief latency blip instead of a full application failure, since the gateway can silently retry against a secondary model while the primary recovers. That resilience layer is the same reason infrastructure teams build redundancy into DNS, load balancing, and database failover — AI providers are simply the newest dependency to get that treatment.
Cloudflare AI Gateway: The Free Edge-Network Option
Cloudflare launched AI Gateway as a feature bolted onto its existing edge network rather than a standalone product, and that lineage shows in the pricing: the core feature set, including analytics, caching, rate limiting, and request retries, is free according to Cloudflare’s own AI Gateway pricing documentation. There is no seat fee and no percentage-of-spend markup, which is unusual in this market. The catch is on log volume: the AI Gateway limits reference caps Workers Free accounts at 100,000 total logs across all gateways, while Workers Paid accounts get up to 10 million logs per gateway.
Cloudflare’s own AI Gateway launch post described initial support for OpenAI, Hugging Face, and Replicate, and the product has broadened from there into a “multiple providers through a single endpoint” model, per the company’s AI Gateway changelog. Cache TTL tops out at one month, and the cacheable request size ceiling sits at 25 MB — generous enough for most chat completions and moderate image payloads, but a real constraint for teams caching large multimodal responses.
On August 7, 2026, Cloudflare unified billing between Workers AI and AI Gateway, meaning the gateway’s analytics, caching, rate limiting, and retry logic now sit on top of the same model-access layer that bills for Workers AI inference. That matters for teams already running inference on Cloudflare’s network rather than routing out to a third-party provider — the gateway and the compute now share one bill instead of two dashboards. For teams building on Cloudflare’s edge compute already, this pairs naturally with a stack that includes Cloudflare Workers instead of Lambda for the surrounding application logic.
Cloudflare’s Real Trade-Off
Free is free, but Cloudflare AI Gateway is not trying to be an enterprise LLM-ops platform. There is no dedicated guardrails product comparable to Portkey’s, no semantic caching layer as of this writing, and governance features lean on Cloudflare’s broader access-control stack rather than AI-specific policy primitives. Teams that already route traffic through Cloudflare for CDN or WAF reasons get the gateway essentially for free as an add-on. Teams starting from zero, with no existing Cloudflare footprint, will likely find Portkey or Kong give them more AI-specific tooling out of the box.
Portkey: The AI-Native Gateway That Went Open Source
Portkey was built from day one as an AI gateway rather than a general API management tool extended into AI, and its roadmap in 2025-2026 reflects that focus. In March 2026, Portkey made its unified gateway fully open source under an MIT license, covering governance, observability, authentication, and cost controls in the free self-hosted build — a notable shift for a company that started as a closed SaaS product. The company’s February 2026 changelog shows the gateway adding gRPC support that same quarter, extending beyond the REST-only interface most competitors still ship.
Portkey’s hosted pricing runs in three tiers. The Developer tier is free and includes 10,000 recorded logs per month with 3-day log retention and 30-day metrics retention. Production is $49 a month, steps up to 100,000 recorded logs, extends retention to 30 days for logs and 90 days for metrics, and adds semantic caching plus LLM guardrails. Overage beyond the included volume runs $9 per additional 100,000 requests, capped at 3 million requests a month before a custom Enterprise contract kicks in. Enterprise tiers, aimed at organizations logging 10 million-plus requests monthly, add custom guardrail hooks and dedicated support, according to Portkey’s own AI gateway buyer’s guide.
Provider breadth is where Portkey leans hardest into its AI-native positioning: it advertises support for more than 1,600 LLMs spanning OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, Groq, Together AI, Mistral, and Cohere, all behind one unified API signature, per Portkey’s leading LLM gateway platforms comparison. That single-signature approach matters for teams that want to swap a model provider without rewriting application code — the same value proposition that has made open-source routers like LiteLLM popular, a tool this site has covered in a LiteLLM router setup guide showing a 14x API cost cut.
Portkey’s Real Trade-Off
Portkey’s pricing model scales with request volume rather than a flat platform fee, which is straightforward at low volume but can turn into a bill shock for a team whose traffic spikes unpredictably — the $9-per-100,000-request overage adds up fast for a chat product that goes viral. The open-source March 2026 release mitigates that for teams willing to self-host, trading a subscription bill for the operational overhead of running and scaling the gateway themselves.
Kong AI Gateway: API Management Incumbent Goes AI-Native
Kong took the opposite path from Portkey: instead of building an AI-native product from scratch, it extended Konnect, its existing API management control plane, to treat LLM traffic as another protocol to govern alongside REST and gRPC. That lineage is Kong’s biggest asset for enterprises that already run Kong for traditional API management — the same control plane and policy engine already evaluated in this site’s Kong vs AWS API Gateway vs Apigee comparison now extends to AI traffic without a second platform to learn.
Kong shipped AI Gateway 2.0 as a general-availability release in 2026, adding support for Kimi, Microsoft Foundry, and Amazon SageMaker as new model providers, according to Kong’s AI Gateway 2.0 GA announcement. That release also introduced a reusable pricing catalog spanning text, audio, image, and video modalities, with distinct cache-read and cache-write cost fields — a level of pricing granularity neither Cloudflare nor Portkey publishes as cleanly. The same release added MCP Server Bundling, dynamic modality-aware cost management, identity-aware AI policies, and native IAM authentication for Amazon Bedrock AgentCore, which pairs directly with the agent-hosting landscape covered in this site’s AWS Bedrock AgentCore vs Azure AI Foundry vs Vertex AI Agent Builder comparison.
An April 2026 follow-up release, AI Gateway 3.14, extended policy coverage to self-hosted vLLM deployments alongside cloud-hosted models, per Kong’s 3.14 release notes, letting enterprises apply the same governance rules whether a model runs on a hyperscaler or on internal GPU infrastructure. Kong’s pricing page also highlights token-level tracking and real-time cost analytics as part of its broader AI Observability feature set, listed on Kong’s pricing page.
Kong’s Real Trade-Off
Kong AI Gateway is not a lightweight add-on. Independent 2026 pricing breakdowns put Konnect gateway service costs at roughly $105 per month per gateway service plus approximately $34.25 per million API requests on paid tiers, and mid-sized enterprise deployments commonly exceed $50,000 annually once support, advanced governance, and multiple environments are factored in. That cost buys deep enterprise governance and a single control plane spanning both traditional and AI APIs, but it puts Kong out of reach for a solo developer or small startup comparing it against Cloudflare’s free tier or Portkey’s $49-a-month Production plan.
Full Specs Comparison
| Attribute | Cloudflare AI Gateway | Portkey | Kong AI Gateway |
|---|---|---|---|
| Entry pricing | Free (core features) | Free Developer tier | ~$105/mo per gateway service + usage |
| Paid tier starting price | Bundled into Workers Paid ($5/mo base) | $49/mo (Production) | ~$34.25 per 1M requests on top of base |
| Provider count | Multiple, unified endpoint (started with OpenAI, Hugging Face, Replicate) | 250+ LLMs including Bedrock, Azure OpenAI, Groq, Mistral, Cohere | Broad; adds Kimi, Microsoft Foundry, Amazon SageMaker in 2.0 |
| Caching | Exact-match, up to 1-month TTL, 25MB request cap | Semantic caching (Production tier+) | Cache-read/cache-write cost fields per modality |
| Log retention (entry tier) | 100,000 logs total (Workers Free) | 3-day logs / 30-day metrics (Developer) | Enterprise-managed retention |
| Log retention (paid tier) | 10,000,000 logs per gateway (Workers Paid) | 30-day logs / 90-day metrics (Production) | Enterprise-managed retention |
| Guardrails | Not a dedicated product; relies on broader Cloudflare access controls | LLM guardrails (Production); custom hooks (Enterprise) | Identity-aware AI policies |
| Self-hosted / open source option | N/A (edge-network SaaS only) | Yes, MIT-licensed since March 2026 | N/A (Konnect-managed) |
| Protocol support | REST via unified endpoint | REST + gRPC (added February 2026) | REST, gRPC, MCP Server Bundling |
| Self-hosted model support | Limited | Yes, via OSS gateway | Yes, vLLM policy coverage since 3.14 (April 2026) |
| Best-fit buyer | Teams already on Cloudflare’s edge network | AI-native startups wanting fast setup and OSS flexibility | Enterprises with existing Kong/Konnect deployments |
| Billing model | Free core + Workers usage | Flat tier + per-request overage | Per-gateway-service + per-million-requests |
Pricing at Three Scale Tiers
Raw feature lists rarely tell the whole story, since the products bill on entirely different axes: Cloudflare bills for edge-network usage, Portkey bills per logged request, and Kong bills per gateway service plus per-million-requests. Here is how the three stack up across a small side project, a mid-size production app, and an enterprise deployment logging tens of millions of requests a month.
| Scale tier | Cloudflare AI Gateway | Portkey | Kong AI Gateway |
|---|---|---|---|
| Hobby project (under 10K requests/mo) | $0 (Workers Free log cap covers it) | $0 (Developer tier, 10,000 logs/mo) | Not cost-effective; base fee alone exceeds most hobby budgets |
| Mid-size app (~100K-1M requests/mo) | $5/mo Workers Paid base + usage | $49/mo Production + overage above 100K logs | ~$105/mo per gateway service + ~$34.25 per additional 1M requests |
| Enterprise (10M+ requests/mo) | Workers Paid usage-based, no flat enterprise SKU | Custom Enterprise contract, 10M+ logs/mo | Commonly $50,000+/year with support and governance add-ons |
The crossover point matters more than the headline price. A startup logging a few hundred thousand requests a month will find Cloudflare and Portkey nearly interchangeable on cost, with the deciding factor coming down to whether the team wants semantic caching and guardrails (Portkey) or a zero-config add-on to infrastructure it already runs (Cloudflare). Kong only starts to make financial sense once an organization needs the governance and support that come with an existing Konnect contract — paying its per-gateway-service fee for a small side project makes little sense next to two free-tier alternatives.
Latency, Caching, and Reliability
Every gateway adds a hop between the application and the model provider, and that hop has to earn its keep through caching or fallback reliability, or it is pure overhead. Portkey publishes a latency claim of under 100ms added by the gateway layer itself, positioning it as a thin proxy rather than a heavyweight middleware stack. Cloudflare does not publish a single latency number for AI Gateway, but its position on the edge network — the same network handling caching and routing decisions for a large share of global web traffic — gives it a structural advantage for teams whose users are geographically distributed, since the gateway hop happens at the nearest edge location rather than a centralized region.
Cache TTL and size limits differ meaningfully between the two SaaS options. Cloudflare’s one-month maximum TTL and 25MB cacheable request size favor high-repeat, moderate-payload workloads like chat completions or short-form content generation. Portkey’s semantic caching, available from the Production tier up, goes a step further by matching semantically similar (not just byte-identical) prompts, which can catch a much larger share of cache hits for user-facing chat products where the same question gets phrased ten different ways. Kong’s cache-read and cache-write cost fields, introduced in AI Gateway 2.0, suggest a more granular billing model for caching rather than a fixed free allowance, which matters for high-volume enterprise deployments trying to model caching ROI precisely.
Governance, Guardrails, and Shadow AI Controls
Governance is where the three products diverge most sharply, and it is increasingly the feature that decides enterprise procurement, not raw pricing. Kong’s 2026 releases lean hardest into this: identity-aware AI policies and native IAM authentication for Amazon Bedrock AgentCore mean a security team can apply the exact same access-control model to an AI agent that it already applies to a microservice calling an internal API. MCP Server Bundling, also shipped in AI Gateway 2.0, extends that governance to the Model Context Protocol servers increasingly used to give AI agents tool access — a fast-growing attack surface that has already produced real incidents, including the vulnerability disclosed in this site’s coverage of LiteLLM’s first CISA-flagged MCP flaw.
Portkey’s guardrails are tier-gated: basic LLM guardrails ship with the Production plan, while custom guardrail hooks (letting a team plug in its own moderation or PII-redaction logic) are reserved for Enterprise. That structure works well for a mid-size team willing to pay $49 a month for baseline protection but forces a jump to a custom contract for anything more specific to a regulated industry.
Cloudflare is the outlier here: it does not ship a dedicated AI guardrails product as of this writing, instead relying on the access-control, firewall, and bot-management tooling already built into its broader platform. That is a reasonable trade-off for a team that already uses Cloudflare for WAF and wants one less vendor, but it means AI-specific content moderation has to be built in the application layer rather than configured in the gateway.
Benchmarks: Latency, Caching, and Provider Coverage From Independent Sources
Independent, apples-to-apples load-test benchmarks across all three gateways are thin on the ground in 2026 — a gap this article will not paper over with invented numbers. What does exist is a mix of vendor-published figures and third-party pricing and architecture teardowns, and reading them side by side still surfaces real differences worth weighing.
| Metric | Cloudflare (vendor docs) | Portkey (vendor + third-party reviews) | Kong (vendor + independent pricing analyses) |
|---|---|---|---|
| Added latency | Not separately published; runs on Cloudflare’s edge points of presence | Under 100ms claimed by vendor and repeated across third-party 2026 reviews | Not published as a standalone figure; observability focuses on cost, not raw latency |
| Max cache TTL | 1 month (documented limit) | Not a fixed TTL; semantic matching instead of pure time-based expiry | Cache-read/cache-write are billed line items rather than a published TTL ceiling |
| Max cacheable request size | 25MB (documented limit) | Not published as a hard cap in the gathered sources | Not published as a hard cap in the gathered sources |
| Provider count (approx.) | Multiple, unified endpoint; started with 3 (OpenAI, Hugging Face, Replicate) and expanded since | 250+, per vendor buyer’s guide | Broad enterprise set; added Kimi, Microsoft Foundry, SageMaker in the 2.0 release |
| Protocol coverage | REST via unified endpoint | REST + gRPC (added Feb. 2026) | REST, gRPC, plus MCP Server Bundling |
The honest takeaway from this table is that the AI gateway category has not yet produced a neutral, third-party benchmark suite the way, say, database vendors get put through TPC-style tests. Buyers evaluating these products today are largely working from vendor-published numbers cross-checked against independent pricing and architecture write-ups, which is exactly why this comparison leans on documented limits and shipped features rather than a single composite score.
Real-World Use Cases: Which Gateway Fits Which Team
Five concrete scenarios illustrate how the choice plays out in practice.
- Solo developer building a SaaS MVP on Cloudflare Workers. Cloudflare AI Gateway is the obvious pick: it is free, it lives in the same dashboard as the Workers deployment, and the August 2026 unified billing update means one invoice covers both compute and gateway usage. There is no reason to add a second vendor at this stage.
- AI-native startup that needs to swap providers weekly for cost arbitrage. Portkey’s 250+ provider support and unified API signature make provider swaps a config change rather than a code change. The Production tier’s semantic caching also pays for itself quickly on a chat product with repetitive query patterns.
- Regulated enterprise (healthcare, finance) already running Kong Konnect. Kong AI Gateway extends the existing compliance and access-control investment to AI traffic without introducing a second platform for the security team to audit. The identity-aware policies and IAM integration with Bedrock AgentCore matter more here than the higher price tag.
- Team running open-weight models on internal GPUs alongside cloud APIs. Kong’s 3.14 vLLM policy coverage or Portkey’s self-hosted OSS gateway both support this hybrid pattern; Cloudflare’s edge-network model is a weaker fit since it is built around routing to external providers rather than governing an internal inference cluster.
- Agency running dozens of small client projects on tight budgets. Cloudflare or Portkey’s free tiers cover most of these outright, and only the largest client accounts would need to graduate to Portkey Production or a Kong contract.
- Fintech or healthtech company under active compliance audit. Kong’s identity-aware AI policies give a compliance team an audit trail that ties a specific authenticated identity to every model call, which is a much easier story to tell an auditor than reconstructing usage from application logs after the fact.
- Media or content company running high-volume image and video generation. Kong’s modality-aware pricing catalog, with distinct cost fields for text, audio, image, and video, gives finance a clearer per-format cost breakdown than either Cloudflare or Portkey currently publish, which matters once video generation costs start dwarfing text costs on the same bill.
Migration Guide: Moving From Direct API Calls to a Gateway
Migrating an application that currently calls OpenAI, Anthropic, or another provider directly follows roughly the same pattern across all three gateways, since each is designed to be a drop-in proxy rather than a rewrite.
- Audit every place in the codebase that currently holds a provider API key or makes a direct HTTPS call to a model endpoint.
- Pick a gateway based on existing infrastructure: Cloudflare if the app already runs on Workers, Portkey for a clean AI-native setup, Kong if the organization runs Konnect already.
- Create the gateway instance and generate a virtual key or endpoint URL that will replace the direct provider key in application code.
- Update the base URL in the application’s HTTP client or SDK configuration to point at the gateway endpoint instead of the provider’s endpoint directly.
- Configure provider credentials inside the gateway itself (Cloudflare and Portkey both support storing multiple provider keys centrally, removing them from application code entirely).
- Enable caching with a conservative TTL first (start at hours, not the maximum) and monitor cache hit rates before extending it.
- Set rate limits per API key or per team to establish a cost ceiling before rolling out to all traffic.
- Configure fallback chains so a provider outage or rate-limit error automatically retries against a secondary provider.
- Route a small percentage of production traffic through the gateway first (a canary rollout) and compare latency and error rates against the direct-call baseline.
- Turn on cost analytics and tag requests by team or feature to establish the spend baseline finance will use going forward.
- Once the canary is stable for at least a week, cut over 100% of traffic and remove the direct provider integration code.
- Revoke the original, ungated provider API keys so all traffic is forced through the gateway going forward.
The step most teams skip is the last one. Leaving old, ungated keys active defeats the entire governance purpose of adding a gateway, since any script or forgotten integration can still bypass it entirely.
Pros and Cons
| Gateway | Pros | Cons |
|---|---|---|
| Cloudflare AI Gateway | Free core features; unified billing with Workers AI; edge-network latency advantage; simple setup for existing Cloudflare users | No dedicated guardrails product; no semantic caching; log caps on free tier; weaker fit for self-hosted model governance |
| Portkey | 250+ providers behind one API; semantic caching; MIT-licensed OSS option since March 2026; sub-100ms added latency claim; gRPC support | Per-request overage can spike unpredictably; best guardrail features gated behind Enterprise; younger company than Kong with a shorter enterprise track record |
| Kong AI Gateway | Deep governance and identity-aware policies; single control plane for REST, gRPC, MCP, and AI traffic; vLLM support for self-hosted models; granular modality-based cost tracking | Expensive relative to free alternatives; overkill for small teams; steeper learning curve tied to the broader Konnect platform |
Documentation, Ecosystem, and Support
A gateway is infrastructure a team lives inside every day, so documentation quality and community size matter as much as the feature checklist. Cloudflare’s documentation benefits from being part of the company’s much larger developer platform — the same docs site, the same account dashboard, and the same support channels used for Workers, R2, and the rest of the edge stack. That familiarity cuts onboarding time for anyone who has already deployed something else on Cloudflare, but AI Gateway-specific guides are thinner than the coverage given to flagship products like Workers.
Portkey, as a smaller and younger company, leans on changelog transparency and buyer’s guides to compensate for a smaller support organization; its public changelog cadence (gRPC support landing in February 2026, the open-source release in March 2026) gives prospective buyers a clear signal of active development. Kong’s documentation inherits the depth of a mature, decade-old API management product, and its release notes for AI Gateway 2.0 and 3.14 read like enterprise software release notes, complete with detailed changelogs, migration notes, and versioned policy documentation, reflecting the buyer base of large, contract-driven enterprises rather than self-serve developers.
| Factor | Cloudflare AI Gateway | Portkey | Kong AI Gateway |
|---|---|---|---|
| Support model | Shared with broader Cloudflare support tiers | Community (free), email/priority (Production), dedicated (Enterprise) | Enterprise account management standard on paid contracts |
| Release cadence signal | Rolled into general platform changelog | Dedicated monthly changelog (e.g., gRPC in Feb. 2026) | Named versioned releases (2.0 GA, 3.14) |
| Best documentation for | Teams already fluent in Cloudflare’s dashboard and Workers docs | Developers wanting fast, self-serve setup guides | Enterprise architects planning a multi-environment rollout |
| Community/ecosystem size signal | Backed by Cloudflare’s broad developer base | Smaller, growing fast post open-source release | Backed by Kong’s established API management customer base |
The Broader AI Gateway Market in 2026
Cloudflare, Portkey, and Kong are not the only names in this category. Helicone and the open-source LiteLLM proxy remain popular for teams that want a lighter-weight, self-hosted option, and this site’s own LiteLLM router guide walks through standing one up in 14 steps. TrueFoundry, Databricks’ AI Gateway (part of Mosaic AI), Azure API Management’s AI gateway extension, and AWS’s Bedrock-adjacent gateway tooling round out the field for teams already committed to a specific cloud or MLOps platform. The common thread across all of them in 2026 is the same three drivers: token-cost control, multi-model fallback routing, and governance over what used to be invisible shadow AI usage.
| Alternative | Model | Where it fits vs. this comparison’s three |
|---|---|---|
| LiteLLM proxy | Open source, self-hosted | Lighter-weight than any of the three; a code library and lightweight proxy rather than a managed platform |
| Helicone | SaaS + open-source option | Observability-first positioning, closer to Portkey’s early product than to Cloudflare or Kong |
| Databricks AI Gateway (Mosaic AI) | Platform-bundled | Best fit for teams already running model training and serving on Databricks |
| Azure API Management AI gateway extension | Cloud-bundled | Natural fit for Azure-committed enterprises already using APIM for non-AI APIs |
| AWS Bedrock-adjacent gateway tooling | Cloud-bundled | Closest analog to Kong’s IAM-integrated approach, but scoped to AWS-hosted models |
That governance angle is becoming inseparable from broader agent infrastructure. As enterprises move from single-shot chat completions toward autonomous agents that call tools and other services, the gateway increasingly has to govern not just a model call but everything downstream of it — which is exactly why Kong’s MCP Server Bundling and Bedrock AgentCore IAM integration shipped in the same release. Expect Cloudflare and Portkey to add comparable agent-governance features within the next few product cycles, since none of the three can afford to cede that ground as agentic workloads scale.
Setup Complexity Compared
Time-to-first-request differs meaningfully across the three. Cloudflare AI Gateway can be live in minutes for a team already using Workers or Workers AI, since it is a dashboard toggle plus a URL change rather than a new account and billing relationship. Portkey’s hosted Developer tier follows a similarly fast signup-to-first-call flow, though teams choosing the self-hosted OSS route should expect the same operational overhead as running any proxy service: container orchestration, secrets management, and monitoring become the team’s responsibility rather than the vendor’s.
Kong AI Gateway is the outlier on setup time. Because it lives inside Konnect, a team with no existing Kong footprint is effectively standing up a full API management platform, not just an AI proxy. That is a multi-day to multi-week project involving control-plane provisioning, data-plane deployment, and policy configuration — a meaningfully larger lift than either Cloudflare or Portkey, but one that pays off for organizations that need Kong’s governance depth anyway for non-AI APIs.
# Example: pointing an OpenAI SDK client at each gateway instead of the provider directly
# Cloudflare AI Gateway
client = OpenAI(
base_url="https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openai",
api_key=OPENAI_API_KEY
)
# Portkey
client = OpenAI(
base_url="https://api.portkey.ai/v1",
api_key=PORTKEY_API_KEY,
default_headers={"x-portkey-provider": "openai"}
)
# Kong AI Gateway (via Konnect route)
client = OpenAI(
base_url="https://{konnect_route}/ai-gateway/openai",
api_key=KONG_VIRTUAL_KEY
)Cost Control: Where Each Gateway Actually Saves Money
Caching is the single biggest lever across all three products, since a cache hit costs nothing in provider tokens regardless of which gateway serves it. Beyond caching, each product’s savings mechanism differs. Cloudflare’s free tier removes gateway cost entirely, so the only spend is provider tokens plus whatever Workers usage the surrounding app already generates. Portkey’s semantic caching catches a wider net of near-duplicate prompts than Cloudflare’s exact-match caching, which matters most for high-traffic consumer chat products where phrasing varies but intent repeats. Kong’s modality-aware cost catalog, distinguishing text, audio, image, and video pricing with separate cache-read and cache-write fields, gives finance teams the most granular cost model of the three, at the cost of a higher base platform fee to access it.
Fallback routing is a secondary but real cost lever: catching a rate-limited or failed request and retrying against a cheaper or faster secondary provider avoids both a failed user request and, in some configurations, a more expensive retry against the same provider. All three products support this pattern, though Portkey and Kong both document it more explicitly as a first-class routing feature than Cloudflare does today.
Rate limiting is the third lever, and it is as much about preventing runaway spend as it is about traffic shaping. A single buggy retry loop in application code calling an expensive reasoning model directly can produce a five-figure bill before anyone notices; a rate limit configured at the gateway catches that failure mode within minutes instead of at the end of a billing cycle. All three products support per-key and per-team rate limiting, though the granularity of what can be limited — requests per minute, tokens per minute, or spend per day — varies by tier and vendor, and it is worth checking the exact limiting dimensions each vendor supports before assuming parity.
The Verdict
There is no single winner here because the three products are not really competing for the same buyer. Cloudflare AI Gateway wins on pure economics for any team already on Cloudflare’s network: free core features, unified billing with Workers AI as of August 2026, and edge-network latency make it close to a no-brainer default for that audience. Portkey wins for teams that want the deepest AI-specific feature set — 250+ providers, semantic caching, and an MIT-licensed self-hosted option since March 2026 — without committing to enterprise pricing. Kong AI Gateway wins for regulated enterprises that need identity-aware governance spanning both AI and traditional APIs, and that already have, or are willing to build, a Konnect deployment to support it.
The practical starting point for most teams reading this in September 2026: default to Cloudflare if already on that network, default to Portkey if starting fresh and want the fastest path to a full-featured gateway, and reach for Kong only once governance requirements or an existing Konnect investment make the higher cost worth it. All three are converging toward the same feature set over time — caching, fallback, guardrails, and agent-aware governance — so the deciding factor increasingly comes down to which vendor’s existing footprint an organization is already standing on rather than which one has the longer feature list today.
Frequently Asked Questions
Is Cloudflare AI Gateway really free?
The core features — analytics, caching, rate limiting, and request retries — are free according to Cloudflare’s own pricing documentation. The limits are on log volume: 100,000 total logs across all gateways on Workers Free, and up to 10 million logs per gateway on Workers Paid, which starts at $5 a month for the base Workers plan.
How many LLM providers does Portkey support?
Portkey advertises support for more than 250 LLMs, including OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, Groq, Together AI, Mistral, and Cohere, all accessible through one unified API signature.
Can I self-host Portkey instead of using the hosted SaaS version?
Yes. Portkey made its unified gateway fully open source under an MIT license in March 2026, including governance, observability, authentication, and cost-control features in the self-hosted build.
Is Kong AI Gateway the same product as Kong’s traditional API Gateway?
Kong AI Gateway is built inside Konnect, the same control plane used for Kong’s traditional REST and gRPC API management, rather than being a separate standalone product. That means an organization already running Kong Konnect can extend its existing policies and control plane to cover AI traffic without adopting a second platform.
Which AI gateway has the lowest added latency?
Portkey publishes a claim of under 100ms of added latency from its gateway layer. Cloudflare does not publish a single comparable figure but benefits structurally from running on its own edge network, which can reduce round-trip time for geographically distributed users. Kong does not publish a headline latency figure either, focusing its published metrics on cost and governance instead.
Do these gateways support self-hosted open-weight models like Llama or Mistral running on internal GPUs?
Kong added policy coverage for self-hosted vLLM deployments in its AI Gateway 3.14 release in April 2026, letting the same governance rules apply to internal and cloud-hosted models. Portkey supports this pattern through its self-hosted open-source gateway. Cloudflare AI Gateway is primarily built around routing to external cloud providers and has more limited native support for governing purely internal inference clusters.
What does Kong AI Gateway cost for a mid-size enterprise deployment?
Independent 2026 pricing analyses put Konnect gateway service costs at roughly $105 per month per gateway service, plus approximately $34.25 per million API requests on paid tiers. Mid-sized enterprise deployments that add support, advanced governance, and multiple environments commonly exceed $50,000 annually.
Do I need an AI gateway if I only call one model provider?
Even single-provider setups benefit from caching, rate limiting, and cost visibility, but the fallback-routing and multi-provider arbitrage benefits that justify a gateway for many teams disappear if there is only one provider to route between. A team in that position may get more value from a lighter-weight, free option like Cloudflare AI Gateway than from Portkey’s paid tiers or a Kong deployment.
