License & Deployment Mix: 17 tools – 11 OSS, 6 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is an API Gateway?
An API gateway is a server that sits between API clients and backend services, acting as the single entry point for all API traffic. It handles cross-cutting concerns – authentication, rate limiting, request transformation, load balancing, caching, and observability – so that backend services can focus on business logic.
API gateways differ from general reverse proxies (like Traefik or Nginx) by focusing specifically on API lifecycle management: versioning, developer portals, API key management, usage analytics, and contract enforcement. A reverse proxy routes traffic; an API gateway manages the entire API lifecycle.
API gateways differ from service meshes (like Istio or Linkerd) by operating at the edge (north-south traffic) rather than between internal services (east-west traffic). Some tools blur these boundaries – Envoy powers both API gateways and service meshes, and Kong can operate at both layers.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This evaluation covers API gateway tools that complement a reverse proxy (such as Traefik) by adding API-specific lifecycle management: consumer auth, rate limiting, developer portals, analytics, and request transformation.
SSO / OIDC Comparison
OIDC is the preferred SSO protocol; the notes below assume Authentik as the IdP.
API gateways use identity providers for two purposes: admin UI authentication (SSO) and API consumer authentication (OAuth 2.0 / JWT validation).
| Tool | OIDC | SAML | SCIM | Authentik Notes |
|---|---|---|---|---|
| Kong OSS | Yes (plugin) | No | No | JWT + OIDC plugins; Authentik as IdP; consumer tokens |
| APISIX | Yes (plugin) | No | No | openid-connect plugin; Authentik as IdP; JWT validation |
| Tyk OSS | Yes | No | No | Native OIDC; Authentik as IdP; JWT middleware |
| KrakenD | Yes | No | No | JWT validator; Authentik JWKS endpoint; no admin UI |
| Gravitee | Yes | Yes | No | Native OIDC for admin + API consumers; Authentik as IdP |
| Envoy GW | Yes (ext) | No | No | External auth (ext_authz); Authentik via OIDC proxy |
| Gloo Edge | Yes | No | No | ExtAuth with OIDC; Authentik as IdP; JWT validation |
| Traefik Hub | Yes | No | No | OIDC for API portal; Authentik as IdP; JWT validation |
| Express GW | Yes (plugin) | No | No | OAuth2 plugin; Authentik as provider; basic OIDC |
| Fusio | Yes | No | No | Native OAuth2/OIDC; Authentik as external IdP |
| Kong Ent | Yes | Yes | No | OIDC plugin (enterprise); Authentik OIDC + SAML |
| Tyk Cloud | Yes | Yes | No | Native OIDC + SAML; Authentik as IdP; portal SSO |
| Apigee | Yes | Yes | Yes | Google IdP or external OIDC; Authentik federation |
| AWS API GW | Yes* | No | No | Cognito or custom authorizer; Authentik via OIDC |
| Azure APIM | Yes | Yes | Yes | Entra ID or external OIDC; Authentik federation |
| MuleSoft | Yes | Yes | Yes | Anypoint IdP or external OIDC; Authentik federation |
* = requires additional configuration or intermediary service
Best SSO support: Apigee, Azure APIM, MuleSoft (OIDC + SAML + SCIM)
Best OSS SSO: Gravitee, Tyk OSS, Kong OSS (native OIDC for admin and consumer auth)
No native SSO: KrakenD has no admin UI (JWT validation only for API consumers)
API Comparison
| Tool | API Type | Auth | Webhooks | SDKs | Terraform |
|---|---|---|---|---|---|
| Kong OSS | REST | API key, JWT | Yes (plugin) | Multi-lang | Yes (official) |
| APISIX | REST | API key | Yes (plugin) | None | Yes (community) |
| Tyk OSS | REST | API key | Yes | Go, Python | Yes (official) |
| KrakenD | Config file | N/A (no admin API) | No | None | No |
| Gravitee | REST | Token, OAuth2 | Yes | Java | Yes (community) |
| Envoy GW | K8s CRDs | kubectl | No | Go | Yes (K8s provider) |
| Gloo Edge | K8s CRDs + REST | Token | Yes | Go | Yes (official) |
| Traefik Hub | REST + K8s CRDs | Token | Yes | None | Yes (official) |
| Express GW | REST | API key | No | Node.js | No |
| Fusio | REST | Token, OAuth2 | Yes | PHP | No |
| Kong Ent | REST | RBAC, JWT | Yes | Multi-lang | Yes (official) |
| Tyk Cloud | REST | API key, OAuth2 | Yes | Multi-lang | Yes (official) |
| Apigee | REST + gRPC | OAuth2 | Yes | Multi-lang | Yes (official) |
| AWS API GW | REST (AWS) | IAM, API key | Yes (EventBridge) | AWS SDKs | Yes (official) |
| Azure APIM | REST (Azure) | Entra, key | Yes (Event Grid) | Azure SDKs | Yes (official) |
| MuleSoft | REST | OAuth2 | Yes | Java, JS | Yes (community) |
Deployment Comparison
| Tool | Self-Hosted | K8s | Docker | SaaS | Database |
|---|---|---|---|---|---|
| Kong OSS | Yes | Yes (Helm) | Yes | No | PostgreSQL or DB-less |
| APISIX | Yes | Yes (Helm) | Yes | No | etcd |
| Tyk OSS | Yes | Yes (Helm) | Yes | No | Redis |
| KrakenD | Yes | Yes (Helm) | Yes | No | None (stateless) |
| Gravitee | Yes | Yes (Helm) | Yes | Yes | MongoDB + Elasticsearch |
| Envoy GW | K8s only | Yes | No | No | K8s etcd |
| Gloo Edge | K8s only | Yes | No | No | K8s etcd |
| Traefik Hub | Yes | Yes | Yes | Yes | None (stateless) |
| Express GW | Yes | Yes | Yes | No | Redis |
| Fusio | Yes | No | Yes | No | MySQL/PostgreSQL |
| Kong Ent | Yes | Yes (Helm) | Yes | Yes | PostgreSQL |
| Tyk Cloud | No | No | No | Yes | Managed |
| Apigee | Hybrid* | Yes* | No | Yes | Managed |
| AWS API GW | No | No | No | Yes | Managed |
| Azure APIM | Hybrid* | Yes* | Yes* | Yes | Managed |
| MuleSoft | Hybrid* | Yes* | No | Yes | Managed |
* = hybrid option with self-hosted runtime and cloud control plane
Core Gateway Features
| Tool | Rate Limit | Circuit Break | Transform | Cache | Canary |
|---|---|---|---|---|---|
| Kong OSS | Yes (plugin) | Yes (plugin) | Yes (plugin) | Yes (plugin) | Yes (plugin) |
| APISIX | Yes (plugin) | Yes (plugin) | Yes (plugin) | Yes (plugin) | Yes (traffic-split) |
| Tyk OSS | Yes | Yes | Yes | Yes | Yes (% routing) |
| KrakenD | Yes | Yes | Yes (native) | Yes | No |
| Gravitee | Yes (policy) | Yes (policy) | Yes (policy) | Yes (policy) | Yes (sharding) |
| Envoy GW | Yes (policy) | Yes (native) | Limited | No | Yes (HTTPRoute) |
| Gloo Edge | Yes | Yes (Envoy) | Yes | No | Yes (weighted) |
| Traefik Hub | Yes | No | Limited | No | Yes (weighted) |
| Express GW | Yes (plugin) | No | Yes (plugin) | No | No |
| Fusio | Yes | No | Yes | Yes | No |
| Kong Ent | Yes (adv) | Yes | Yes (adv) | Yes (adv) | Yes |
| Tyk Cloud | Yes (adv) | Yes | Yes (adv) | Yes | Yes |
| Apigee | Yes (adv) | Yes | Yes (adv) | Yes (adv) | Yes |
| AWS API GW | Yes | No | Yes (VTL) | Yes | Yes (stage) |
| Azure APIM | Yes (policy) | Yes (policy) | Yes (policy) | Yes (policy) | Yes (revision) |
| MuleSoft | Yes (policy) | Yes | Yes (DataWeave) | Yes | Yes |
Protocol Support
| Tool | REST | gRPC | GraphQL | WebSocket | TCP/UDP |
|---|---|---|---|---|---|
| Kong OSS | Yes | Yes (plugin) | Yes (plugin) | Yes | Yes (stream) |
| APISIX | Yes | Yes (plugin) | Yes (plugin) | Yes | Yes (stream) |
| Tyk OSS | Yes | Yes | Yes | Yes | No |
| KrakenD | Yes | Yes | Yes | No | No |
| Gravitee | Yes | Yes | Yes | Yes | Yes (TCP) |
| Envoy GW | Yes | Yes (native) | No | Yes | Yes (TCP/UDP) |
| Gloo Edge | Yes | Yes (native) | Yes | Yes | Yes (TCP) |
| Traefik Hub | Yes | Yes | No | Yes | Yes (TCP/UDP) |
| Express GW | Yes | No | No | Yes | No |
| Fusio | Yes | No | No | No | No |
| Kong Ent | Yes | Yes | Yes | Yes | Yes (stream) |
| Tyk Cloud | Yes | Yes | Yes | Yes | No |
| Apigee | Yes | Yes | Yes | Yes | No |
| AWS API GW | Yes | No | Yes* | Yes | No |
| Azure APIM | Yes | Yes* | Yes | Yes | No |
| MuleSoft | Yes | Yes | Yes | Yes | No |
* = limited or requires additional configuration
Authentication Methods
| Tool | API Key | JWT | OAuth 2.0 | mTLS | Basic | HMAC |
|---|---|---|---|---|---|---|
| Kong OSS | Yes | Yes | Yes (plugin) | Yes | Yes | Yes |
| APISIX | Yes | Yes | Yes (plugin) | Yes | Yes | Yes |
| Tyk OSS | Yes | Yes | Yes | Yes | Yes | Yes |
| KrakenD | Yes* | Yes | Yes | No | Yes | No |
| Gravitee | Yes | Yes | Yes | Yes | Yes | No |
| Envoy GW | No | Yes (ext) | Yes (ext) | Yes | Yes (ext) | No |
| Gloo Edge | Yes | Yes | Yes | Yes | Yes | No |
| Traefik Hub | Yes | Yes | Yes | Yes | Yes | No |
| Express GW | Yes | Yes | Yes | No | Yes | No |
| Fusio | Yes | Yes | Yes | No | Yes | No |
| Kong Ent | Yes | Yes | Yes | Yes | Yes | Yes |
| Tyk Cloud | Yes | Yes | Yes | Yes | Yes | Yes |
| Apigee | Yes | Yes | Yes | Yes | Yes | Yes |
| AWS API GW | Yes | Yes* | Yes | Yes | No | No |
| Azure APIM | Yes | Yes | Yes | Yes | Yes | No |
| MuleSoft | Yes | Yes | Yes | Yes | Yes | No |
* = requires custom authorizer or additional configuration
Developer Portal
| Tool | Built-in Portal | Self-Service Keys | OpenAPI Docs | Customizable | Analytics |
|---|---|---|---|---|---|
| Kong OSS | No | No | No | N/A | No |
| APISIX | No | No | No | N/A | No |
| Tyk OSS | Yes (basic) | Yes | Yes | Limited | Basic |
| KrakenD | No | No | No | N/A | No |
| Gravitee | Yes | Yes | Yes | Yes | Yes |
| Envoy GW | No | No | No | N/A | No |
| Gloo Edge | No | No | No | N/A | No |
| Traefik Hub | Yes | Yes | Yes | Limited | Basic |
| Express GW | No | No | No | N/A | No |
| Fusio | Yes | Yes | Yes | Limited | Basic |
| Kong Ent | Yes | Yes | Yes | Yes (themes) | Yes |
| Tyk Cloud | Yes | Yes | Yes | Yes (themes) | Yes |
| Apigee | Yes | Yes | Yes | Yes (Drupal) | Yes |
| AWS API GW | No* | Yes (console) | Yes (export) | N/A | Yes (CloudWatch) |
| Azure APIM | Yes | Yes | Yes | Yes (themes) | Yes |
| MuleSoft | Yes | Yes | Yes | Yes | Yes |
* = no built-in portal; use third-party or custom solution
Best OSS portals: Gravitee, Tyk OSS, Fusio (built-in self-service developer portals)
Best commercial portals: Apigee, Azure APIM, MuleSoft, Kong Enterprise (fully customizable with themes and branding)
Kubernetes Integration
| Tool | K8s Native | Gateway API | Ingress | Helm | Operator | CRDs |
|---|---|---|---|---|---|---|
| Kong OSS | Yes | Yes | Yes | Yes | Yes | Yes |
| APISIX | Yes | Yes | Yes | Yes | Yes | Yes |
| Tyk OSS | Yes | No | No | Yes | Yes | No |
| KrakenD | Yes | No | No | Yes | No | No |
| Gravitee | Yes | No | No | Yes | No | No |
| Envoy GW | Yes | Yes (ref) | No | Yes | Yes | Yes |
| Gloo Edge | Yes | Yes | No | Yes | Yes | Yes |
| Traefik Hub | Yes | Yes | Yes | Yes | No | Yes |
| Express GW | Yes | No | No | Community | No | No |
| Fusio | No | No | No | No | No | No |
| Kong Ent | Yes | Yes | Yes | Yes | Yes | Yes |
| Tyk Cloud | N/A | N/A | N/A | N/A | N/A | N/A |
| Apigee | Hybrid | No | No | Yes | Yes | No |
| AWS API GW | N/A | N/A | N/A | N/A | N/A | N/A |
| Azure APIM | Hybrid | No | No | Yes | No | No |
| MuleSoft | Hybrid | No | No | Yes | No | No |
Best K8s Gateway API: Envoy Gateway (reference implementation), Kong, APISIX, Gloo Edge, Traefik Hub
Monitoring Integration
| Tool | Prometheus | StatsD | OpenTelemetry | Access Logs | Health EP |
|---|---|---|---|---|---|
| Kong OSS | Yes (plugin) | Yes (plugin) | Yes (plugin) | Yes | Yes |
| APISIX | Yes (plugin) | No | Yes (plugin) | Yes | Yes |
| Tyk OSS | Yes | Yes | Yes | Yes | Yes |
| KrakenD | Yes | Yes | Yes | Yes | Yes |
| Gravitee | Yes | No | No | Yes | Yes |
| Envoy GW | Yes (native) | Yes (native) | Yes (native) | Yes | Yes |
| Gloo Edge | Yes (native) | Yes | Yes | Yes | Yes |
| Traefik Hub | Yes | No | Yes | Yes | Yes |
| Express GW | Community | No | No | Yes | Yes |
| Fusio | No | No | No | Yes | No |
| Kong Ent | Yes | Yes | Yes | Yes | Yes |
| Tyk Cloud | Yes | Yes | Yes | Yes | Yes |
| Apigee | No* | No | Yes | Yes | Yes |
| AWS API GW | No* | No | Yes | Yes (CW) | Yes |
| Azure APIM | No* | No | Yes | Yes (Monitor) | Yes |
| MuleSoft | No* | No | Yes | Yes | Yes |
* = cloud-native monitoring (not Prometheus); use exporter or integration for Prometheus
Best monitoring integration: Kong, APISIX, Tyk, KrakenD, Envoy Gateway, Gloo Edge (native Prometheus + structured logs)
Tools
17 tools.
Apache APISIX
Apache APISIX is a high-performance, cloud-native API gateway that is part of the Apache Software Foundation and a CNCF project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
Apigee (Google Cloud)
Google Cloud’s API management platform (acquired 2016); one of the most established API management solutions.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
AWS API Gateway
AWS API Gateway is Amazon Web Services’ fully managed API management service. It provides serverless API endpoints that scale automatically with no infrastructure to manage.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Azure API Management
Microsoft’s API management platform with gateway, developer portal, and analytics; admin via Entra ID.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: OIDC, SAML
Emissary-ingress
Emissary-ingress (formerly Ambassador API Gateway / Ambassador Edge Stack OSS) is an Envoy-based Kubernetes API gateway and ingress controller from Ambassador Labs, now a CNCF Incubating project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: OIDC
Envoy Gateway
Envoy Gateway is the reference implementation of the Kubernetes Gateway API using Envoy Proxy as the data plane.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s · SSO: OIDC
Express Gateway
Express Gateway is a lightweight open-source API gateway built on Node.js and Express.js, using YAML-defined pipelines with built-in policies for auth, rate limiting, and proxying.
License: Apache-2.0 (OSS) · Kind: service · Deploy: docker, native · SSO: OIDC
Fusio
Fusio is an open-source API management platform focused on API creation and management rather than pure proxying.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: none
Gloo Edge (Solo.io)
Gloo Edge is an Envoy-based API gateway by Solo.io designed for Kubernetes environments. It extends Envoy Proxy with a Kubernetes-native control plane that simplifies configuration via CRDs.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Gravitee (APIM)
Full APIM with developer portal, API designer, policy studio, analytics, and alerts; native OIDC + SAML for admin and consumer auth.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, native, k8s · SSO: OIDC, SAML
Kong Enterprise (Konnect)
Kong Enterprise (Konnect) is the commercial edition of the Kong API gateway, adding an admin UI, developer portal, analytics (Vitals), RBAC, workspaces, OIDC auth, and a cloud-hosted control plane.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: OIDC, SAML
Kong Gateway (OSS)
Kong is the most widely deployed open-source API gateway. Built on OpenResty (Nginx + Lua), it provides high-performance proxying with an extensible plugin architecture.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: OIDC
KrakenD
KrakenD is a high-performance, stateless API gateway written in Go. Its defining feature is that it requires no database – all configuration lives in a single JSON or YAML file.
License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: none
MuleSoft Anypoint
MuleSoft Anypoint Platform is Salesforce’s integration and API management platform. It combines integration (iPaaS) and API management into a single platform, making it unique among API gateways.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
Traefik Hub
Traefik Hub extends Traefik Proxy with API management – access control (JWT, API keys, OIDC), rate limiting, and a developer API portal – layered on existing Traefik infrastructure.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Tyk (Open Source)
Tyk is a Go-based API gateway with a full API management stack. The open-source gateway handles proxying, authentication, rate limiting, and request transformation.
License: MPL-2.0 (OSS) · Kind: web · Deploy: native · SSO: OIDC
Tyk Cloud
Tyk Cloud is the managed SaaS offering of the Tyk API management platform. It provides the full Tyk stack – gateway, dashboard, developer portal, and analytics – as a managed service without the operational burden of self-hosting.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
