# Alternatives to Kong Kong is an open-source, cloud-native API gateway and management platform for routing, securing, and observing APIs and microservices, with a large plugin ecosystem. Kong ranks #2 of 8 in API gateways, with an Alt Score of 100. It is licensed under Apache-2.0, open source with paid hosting from $25/month and available on the web. 13 of 13 checklist rows are verified against a public source. Source: https://altcatalog.com/alternatives/kong/ Category: API gateways ## Overview - **Who it's for**: Platform and API engineering teams who need to route, secure, and govern API traffic (and increasingly LLM/AI traffic) across microservices and Kubernetes — from individual developers self-hosting the free open-source gateway to enterprises running Kong Konnect's hosted control plane at scale. - **What you get**: Kong Gateway is a free, Apache-2.0 open-source API gateway with authentication, rate limiting, request/response transformation, and a 100+ plugin ecosystem (Lua, Go, JavaScript) plus a Kubernetes Ingress Controller; Kong Konnect layers on a hosted SaaS control plane with developer portals, real-time analytics/observability, service catalog, and AI Gateway features, priced per-resource on the paid Plus tier (starting around $25/month per control plane) or custom Enterprise pricing. - **How it works**: Kong runs as a lightweight NGINX/OpenResty-based proxy sitting in front of your services, configured via a RESTful Admin API, a web UI (Kong Manager or Konnect), or declarative/GitOps-style YAML config (decK) that can be driven from CI/CD pipelines; behavior is extended by attaching plugins to services, routes, or consumers. ## Profile - **License**: Apache-2.0 (verified 2026-07-17) - **Pricing model**: OSS + paid hosting (verified 2026-07-17) - **Starts at**: $25/month (verified 2026-07-17) - **Platforms**: Web - **Status**: active (verified 2026-07-17) ## Ranked alternatives | # | App | Alt Score | Licence | Platforms | |---|-----|-----------|---------|-----------| | 1 | [Gravitee](https://altcatalog.com/alternatives/gravitee.md) | 100 | Apache-2.0 | Web | | 2 | [Tyk](https://altcatalog.com/alternatives/tyk.md) | 100 | MPL-2.0 | Web | | 3 | [WSO2 API Manager](https://altcatalog.com/alternatives/wso2.md) | 100 | Apache-2.0 | Web | | 4 | [Apigee](https://altcatalog.com/alternatives/apigee.md) | 89 | Proprietary — Google Cloud managed service | Web | | 5 | [KrakenD](https://altcatalog.com/alternatives/krakend.md) | 86 | Apache-2.0 | Linux, Web | | 6 | [Traefik Hub](https://altcatalog.com/alternatives/traefik-hub.md) | 86 | Proprietary | Web | | 7 | [Zuplo](https://altcatalog.com/alternatives/zuplo.md) | 86 | Proprietary — Zuplo gateway platform; Zudoku developer portal component is open source (MIT) | Web | Alt Score = Verified coverage (90%) + Visibility (10%). See https://altcatalog.com/how-alt-score-works/ ## Feature comparison Legend: Yes / No / Partial / ? (not verified). | API gateways checklist | Kong | Gravitee | Tyk | WSO2 API Manager | Apigee | KrakenD | |---|---|---|---|---|---|---| | Pricing model | OSS + paid hosting | OSS + paid hosting | OSS + paid hosting | OSS + paid hosting | Usage-based | OSS + paid hosting | | Starts at | $25/month | $2,500/month | Free | Free | $20 per 1M API calls | Free | | License | Apache-2.0 | Apache-2.0 | MPL-2.0 | Apache-2.0 | Proprietary — Google Cloud managed service | Apache-2.0 | | Platforms | Web | Web | Web | Web | Web | Linux, Web | | Open source | Yes | Yes | Yes | Yes | No | Yes | | Self-hostable | Yes | Yes | Yes | Yes | Partial | Yes | | Managed / SaaS option | Yes | Yes | Yes | Yes | Yes | No | | Rate limiting & throttling | Yes | Yes | Yes | Yes | Yes | Yes | | Authentication (OAuth/JWT/API keys) | Yes | Yes | Yes | Yes | Yes | Yes | | Developer portal | Yes | Yes | Yes | Yes | Yes | Partial | | Plugin / extension ecosystem | Yes | Yes | Yes | Yes | Yes | Yes | | Kubernetes-native / ingress | Yes | Yes | Yes | Yes | Yes | Partial | | GraphQL support | Yes | Yes | Yes | Yes | Yes | Yes | | gRPC support | Yes | Yes | Yes | Yes | Yes | Yes | | Analytics & monitoring | Yes | Yes | Yes | Yes | Yes | Yes | | Declarative / GitOps config | Yes | Yes | Yes | Yes | Yes | Yes | | WAF / security policies | Yes | Yes | Yes | Yes | Yes | Yes | ## Sources Sources for Kong. Each alternative is sourced on its own page. - **Status**: active — (verified 2026-07-17) - Note: Latest Kong Gateway release (3.9.3) published 2026-06-17, one month before this research date, indicating ongoing active development. - Quote: “3.9.3” - **License**: Apache-2.0 — (verified 2026-07-17) - Quote: “Apache License Version 2.0, January 2004” - **Pricing model**: OSS + paid hosting — (verified 2026-07-17) - Note: Kong Gateway core is free/open source (Apache-2.0, self-hosted); Kong Konnect (SaaS control plane) is paid, billed per gateway/resource on the Plus tier or custom Enterprise pricing. - Quote: “Plus Charged per Gateway per month, bill monthly” - **Starts at**: $25/month — (verified 2026-07-17) - Note: Cheapest paid Konnect Plus resource (Serverless API Gateway control plane); Plus has no flat base fee, costs are per-resource. Kong Gateway itself remains free to self-host. - Quote: “$25/month per control plane” - **Platforms**: Web — (verified 2026-07-17) - Note: Konnect control plane is a Web app; Kong Gateway itself is self-hosted software that runs on Linux via Docker/Kubernetes/bare metal, not a desktop or mobile app. - Quote: “Whether you’re running in the cloud, on bare metal, or using containers, you can find every supported distribution on our official installation page.” - **Open source**: Yes — (verified 2026-07-17) - Quote: “Kong Gateway is the world’s most adopted open‑source API gateway” - **Self-hostable**: Yes — (verified 2026-07-17) - Quote: “Run Kong Gateway in any environment, platform, and implementation pattern — from on-prem to cloud, Kubernetes, and serverless” - **Managed / SaaS option**: Yes — (verified 2026-07-17) - Quote: “Kong Konnect Free trial $0 for 30 days no credit card required Try everything that the Kong Konnect platform offers with a self-guided tour.” - **Rate limiting & throttling**: Yes — (verified 2026-07-17) - Quote: “Manage ACME certificates, basic rate limiting, and lightweight caching.” - **Authentication (OAuth/JWT/API keys)**: Yes — (verified 2026-07-17) - Quote: “Common methods of API authentication - Basic Auth, HMAC, JWT Key Auth, limited OAuth 2.0, limited LDAP” - **Developer portal**: Yes — (verified 2026-07-17) - Quote: “Drive API adoption with a portal for developers and AI agents” - **Plugin / extension ecosystem**: Yes — (verified 2026-07-17) - Quote: “Plugins for enforcing traffic controls, rate limiting, req/res transformations, logging, monitoring and including a plugin developer hub.” - **Kubernetes-native / ingress**: Yes — (verified 2026-07-17) - Quote: “Kong runs natively on Kubernetes thanks to its official Kubernetes Ingress Controller.” - **GraphQL support**: Yes — (verified 2026-07-17) - Quote: “Convert GraphQL queries to REST requests. Rate limit and cache GraphQL queries” - **gRPC support**: Yes — (verified 2026-07-17) - Quote: “Plugin support for a wide range of protocols including REST, gRPC, GraphQL, WebSockets, UDP, SOAP and Kafka.” - **Analytics & monitoring**: Yes — (verified 2026-07-17) - Quote: “Ensure API and AI performance with real-time observability” - **Declarative / GitOps config**: Yes — (verified 2026-07-17) - Quote: “Drive a GitOps flow of API design and execution” - **WAF / security policies**: Yes — (verified 2026-07-17) - Note: Kong does not ship a product literally branded 'WAF', but offers a Security plugin category covering Bot Detection, IP Restriction, Injection Protection, JSON Threat Protection, and OPA-based authoriz - Quote: “Injection Protection Detect and block injection attacks using regular expressions Enterprise only” --- Ranked by verified data, never by who paid. https://altcatalog.com/trust/