- Three kinds of gateway, by what they sit in front of
- Which part of the gateway is free to run
- Licences and jobs at a glance
- Eight self-hosted gateways, in no particular order
- Do you need Kubernetes to run one?
- Straightforward advice for choosing a gateway
- If you outgrow the free edition
- Frequently asked questions
An open source API gateway is software you run yourself to route, secure and monitor traffic to your APIs. Most use Apache, MIT or MPL licences, but the free repo is often only part of what the vendor sells: dashboards, developer portals and some features can live in a separate enterprise edition, so check the edition before you plan around it.
Once a product has more than a couple of APIs, someone ends up writing the same authentication, rate limiting and logging code in every service. A gateway takes that work into one place in front of your services. The trouble is that open source gateways vary more than their landing pages suggest, both in what they're built to sit in front of and in how much of the product is free to run.
Here are eight self-hostable gateways, in no particular order, alphabetical in the list below and grouped by job in this guide. None is crowned; the right one depends on your stack and whether you already run Kubernetes.
Three kinds of gateway, by what they sit in front of
Standalone gateways with a plugin model
Kong, APISIX, Tyk and KrakenD are the classic API gateways: they sit in front of your services and you extend them with plugins or configuration files. Kong and APISIX lean heavily on plugins, and both mention AI traffic features in their own READMEs. Tyk is written in Go and covers REST, GraphQL, TCP, gRPC and MCP. KrakenD is configured with declarative files and suits backend-for-frontend setups.
Full API management with a portal
Gravitee bundles a gateway with a management console and a developer portal, which is closer to a complete API management product than a gateway alone. You can run it locally with Docker to try it.
Edge proxies and Kubernetes gateways
Traefik is a reverse proxy and ingress controller that discovers services and routes to them, with a built-in dashboard. Emissary and Envoy Gateway are both built on Envoy Proxy: one is configured entirely through Kubernetes resources, while the other runs Envoy as a standalone or Kubernetes-based gateway.
Which part of the gateway is free to run
Read the licence for the edition you'll run, because the repo and the product on a vendor's sales page are often different things. Tyk's README says its gateway has no feature lockout under MPL 2.0, but the control plane with the GUI and developer portal is a separate Enterprise product. KrakenD splits Community and Enterprise editions. Gravitee mentions an Enterprise licence for extra features. Kong's README promotes its hosted Konnect cloud alongside the Apache-licensed gateway.
None of that makes the open source editions less useful; plenty of teams run them for years. It does mean the dashboard you saw in a demo may not be in the download. Licences differ too: the reverse proxy is MIT, Tyk is MPL 2.0, and the rest are Apache 2.0 according to their own pages.
Licences and jobs at a glance
| Tool | Licence (per its repo) | Good for |
|---|---|---|
| Apache APISIX | Apache 2.0 | Dynamic routing and hot-loading plugins on NGINX and etcd |
| Emissary-ingress | Apache 2.0 | Kubernetes-native gateway on Envoy, set up with Kubernetes resources |
| Envoy Gateway | Apache 2.0 | Running Envoy Proxy as a standalone or Kubernetes gateway |
| Gravitee API Management | Apache 2.0; Enterprise licence adds features | Gateway, management console and developer portal together |
| Kong Gateway | Apache 2.0; hosted Konnect is separate | Plugin-based gateway with LLM and MCP traffic features |
| KrakenD Community Edition | Apache 2.0; Enterprise edition separate | File-configured gateway for backend-for-frontend setups |
| Traefik | MIT | Reverse proxy and ingress that discovers services itself |
| Tyk Gateway | MPL 2.0; GUI and portal are Enterprise | REST, GraphQL, TCP, gRPC and MCP traffic, written in Go |
Eight self-hosted gateways, in no particular order
Apache APISIX
Best for: Teams wanting dynamic routing, hot-loaded plugins, load balancing, canary releases and circuit breaking on NGINX and etcd, with AI gateway features via plugins.
Emissary-ingress
Best for: Kubernetes teams configuring an Envoy-based gateway through Kubernetes resources, comfortable with a project that moves slowly; its last commit was in Mar 2026.
Envoy Gateway
Best for: Platform engineers who want Envoy Proxy managed for them, as a standalone gateway or on Kubernetes, with a quickstart in the README.
Gravitee API Management
Best for: Organisations needing a full API management setup, with gateway, console and developer portal, that they can try locally with Docker first.
Kong Gateway
Best for: Engineering teams wanting a plugin-based gateway the vendor says handles API, LLM and MCP traffic, with a Plugin Hub for extensions.
KrakenD Community Edition
Best for: Microservice and backend-for-frontend setups configured with declarative files, where the vendor says the design avoids lock-in.
Traefik
Best for: Container and Kubernetes users wanting a reverse proxy that discovers services and routes to them, from a single binary or small Docker image.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Tyk Gateway
Best for: Developers wanting a Go gateway for REST, GraphQL, TCP, gRPC and MCP that its README says has no feature lockout, minus the GUI.
Do you need Kubernetes to run one?
No, though it changes the shortlist. Several of these run as a single binary or a Docker container on an ordinary server. The Envoy-based options and the ingress controller are at their most natural inside a Kubernetes cluster, and one is configured only through Kubernetes resources. If you don't already run Kubernetes, don't adopt it just to get a gateway.
Straightforward advice for choosing a gateway
Start with where your traffic already lives. If your services run on Kubernetes, look first at the gateways built for it, because they'll fit your deployment tooling. If you run a handful of services on ordinary servers, a standalone gateway with plugins is usually simpler. If outside developers need to discover and sign up for your APIs, you'll want a portal, so check whether it's in the open source edition or only the enterprise one.
Then run the gateway against one real service for a week, with real authentication and rate limits, before rolling it out. Pair it with API monitoring so you'll know when routes fail, and if you're comparing hosted and commercial gateways as well, our wider guide to API gateways covers them.
If you outgrow the free edition
Most teams that move from a community edition to a commercial one do so for the management layer: a GUI, a developer portal, role-based access or support. Keep your routes, plugins and policies in version-controlled configuration from day one, so that moving to an enterprise edition, or to a different gateway, is a configuration job rather than a rebuild. And document your APIs separately from the gateway with one of these API documentation tools, so your docs don't depend on which portal you end up with.
Do you make an open source API gateway or API management tool? Tool makers can ask to be considered for a featured place on this list.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Is there a free open source API gateway?
Yes, several. The gateways here publish their code under Apache, MIT or MPL licences, so you can download and run them yourself. Some features, such as GUIs or developer portals, may sit in a separate enterprise edition.
Do I need Kubernetes for an open source API gateway?
No. Several run on an ordinary server or in a Docker container. Others are built around Kubernetes and make most sense if you already run it.
What's the difference between an open source gateway and open core?
An open source gateway publishes all its code under an open licence. Open core means the base product is open source, but some features, such as a management dashboard or portal, are kept in a separate commercial edition.
What's the difference between an API gateway and a reverse proxy?
A reverse proxy forwards traffic to your services. An API gateway adds API-specific jobs on top, such as authentication, rate limiting, request transformation and analytics. Some tools on this page sit between the two.
Can an open source API gateway handle AI or LLM traffic?
Some vendors say so. A couple of READMEs here describe AI or LLM gateway features, usually through plugins. Check the documentation for the edition you'll run.
Who maintains an open source API gateway?
Usually a company that sells an enterprise edition, a foundation, or a community. Check recent commits and releases before you commit, because some projects move faster than others.
