Skip to content

API Gateways - Kong vs Apigee vs AWS API Gateway vs Tyk#

API gateways are specialised reverse proxies for APIs: authentication, rate limiting, request transformation, schema validation, billing, developer portal.

Side-by-side#

Kong Apigee (Google) AWS API Gateway Tyk Envoy / Gloo Edge KrakenD
Open source core yes (OSS + Enterprise) no (managed only) no yes (OSS + Enterprise) yes (Envoy + Gloo OSS/EE) yes
Data plane NGINX or new Rust-based Managed AWS-managed Custom Go Envoy Custom Go
Hosting Self / Konnect SaaS Google Cloud AWS Self / Cloud Self / Solo cloud Self
Plugins Lua / Go / WASM Java / Node policies Limited (Lambda authorisers) Python / JS / Go WASM / Lua Native
Auth Many plugins Full (OAuth, OpenID, SAML) IAM, Cognito, Lambda authorisers OAuth/JWT/HMAC OAuth, JWT, OIDC JWT, OAuth
Rate limit Built-in Built-in Built-in Built-in Plugin Built-in
Multi-region Self-managed Built-in Regional or edge-optimized Self-managed Self-managed Self-managed
Best fit OSS-first, plugin-rich Enterprise + portal AWS-native serverless OSS with strong defaults Microservice mesh edge Stateless aggregator

Decision tree#

flowchart TB
  Q[New API gateway] --> A{Already on<br/>AWS Lambda/ECS?}
  A -->|yes| AWS[AWS API Gateway]
  A -->|no| B{Need full<br/>enterprise developer portal?}
  B -->|yes| Apigee
  B -->|no| C{Need GraphQL or<br/>response aggregation?}
  C -->|yes| Kraken[KrakenD or Apollo Router]
  C -->|no| D{OSS-friendly,<br/>plugin-rich?}
  D -->|yes| Kong
  D -->|no| Tyk

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class Q,A,B,C,D service;
    class AWS,Apigee,Kraken,Kong,Tyk edge;

What you'll get asked#

  • "API gateway vs service mesh?" Gateway sits at the north-south boundary (external clients); mesh sits east-west (service-to-service). Many use both.
  • "Why not just NGINX?" NGINX works for routing + auth, but lacks plugin ecosystem, dev portal, analytics, OAuth flows.
  • "Cost?" AWS API Gateway charges per request and per GB; can dominate spend at scale. Self-hosted Kong/Envoy is cheaper at scale.

FAQ#

What is the difference between an API gateway and a reverse proxy?#

A reverse proxy routes and load-balances HTTP traffic. An API gateway adds API-specific features on top: authentication, rate limiting, request transformation, schema validation, and developer portals.

Which is better, Kong or AWS API Gateway?#

Kong wins for multi-cloud or on-prem deployments and rich plugins. AWS API Gateway is best when you are all-in on AWS, want serverless, and can live with its quotas and Lambda integration model.

Is Apigee worth the price?#

Apigee is strong for monetisation, partner portals, and large-enterprise governance. For most teams, Kong or Tyk offer 80 percent of the value at a much lower total cost.

Can I use Envoy as an API gateway?#

Yes. Envoy via Gloo Edge, Contour, or Emissary is a popular choice when you already run service mesh on Envoy. Pure Envoy is powerful but lower-level than Kong or Apigee.

When should I use KrakenD?#

KrakenD shines as a backend-for-frontend that aggregates multiple upstream APIs into one tailored response. It is stateless, fast, and well suited to mobile and SPA clients.