Open Source Kong Alternatives

Traffic entering a microservice platform has to be routed, authenticated, limited and observed somewhere. Apache APISIX is the gateway that does it, in real time, and it handles north-south traffic from clients as readily as east-west traffic between services or the job of a Kubernetes ingress controller.

It is built on NGINX and etcd, which is what allows routes, upstreams, certificates and plugins to change without a restart. Configuration goes through an Admin API, nodes are stateless, and a standalone mode reads route rules from a local YAML file instead.

Most of the capability arrives as plugins.

• Traffic control: load balancing, health checks, circuit breaking, traffic splitting, canary releases and request mirroring.
• Protocols: TCP and UDP proxying, gRPC and gRPC Web, gRPC transcoding, Dubbo, MQTT, WebSocket and HTTP/3 with QUIC.
• Security: key, JWT and basic auth, Keycloak and Casbin authorization, IP and referer lists, CORS, CSRF and rate limiting.
• AI gateway: route to several LLM providers behind one interface, with fallbacks and token-based rate limiting.
• Operations: Prometheus metrics, Zipkin and SkyWalking tracing, and discovery through Consul, Nacos, Eureka or Zookeeper.

A quickstart script brings up the gateway and its etcd store from one command on any Docker host, listening on port 9080 with the Admin API on 9180. APISIX runs from bare metal to Kubernetes, supports ARM64, and reports 18k QPS per core at under 0.2 milliseconds of average delay.

Tyk Gateway sits in front of your APIs and absorbs the work that would otherwise be duplicated inside every service behind it. Authentication, rate limiting, quotas and analytics arrive switched on, with no feature held back for a paid tier.

It has been in development since 2014 and speaks REST, SOAP, GraphQL, gRPC and TCP. Kubernetes users can drive it declaratively through the Tyk Operator, and installations exist for Docker, Helm, Ansible, Red Hat, Ubuntu and CentOS, or you can compile it from source.

The middleware chain covers the demands usually placed on a gateway.

• Authentication: OIDC, JWT, bearer tokens, basic auth and client certificates.
• Traffic control: rate limits and quotas per consumer, IP allowlisting and CORS rules per API.
• Content mediation: transform request and response headers, or convert between SOAP and GraphQL.
• Versioning and access: versions set and sunset at a chosen date, with access granted per version and operation.
• Plugins: middleware written in Python, JavaScript, Go or any language that speaks gRPC.
• Hitless reloads: configuration altered and the service restarted without disturbing active requests.

A Docker Compose setup with Redis gets a gateway answering requests in a few minutes, and a hello endpoint confirms it is alive. Tyk Technologies runs the same gateway across its own products, with a commercial control plane, dashboard and developer portal available on top for teams that need them.

Unkey is a developer platform for modern APIs, gathering deployment, traffic routing, key management and usage insight into one place. The argument is consolidation, replacing several pieces of API infrastructure that teams normally stitch together and then maintain separately for years.

The platform is organized as a set of products sharing a workspace.

• Deploy: push an API to production in seconds with no infrastructure to manage.
• Gateway: route, authenticate and shape traffic through globally distributed gateways.
• API keys: issue, verify and revoke keys, with verification that stays fast worldwide.
• Ratelimiting: globally consistent, durable limits applied to any identifier you choose.
• Permissions and RBAC: per-key permissions, roles and fine-grained access control.
• Analytics and audit logs: usage, latency and per-key insight, alongside an immutable history of every workspace action.

One caveat matters before you plan around it. Unkey has paused external code contributions while the team concentrates on platform direction and stability, and pull requests from outside the team will not be reviewed or merged. Issues stay open for bug reports, feature requests and documentation feedback.

The repository is public and source-available, so the code can be read, forked under the AGPL and self-hosted regardless of that policy, which the maintainers say may be revisited. Security problems should go to the team by email rather than into a public issue.

KrakenD Community Edition is the open source distribution of the KrakenD API gateway. It sits between clients and existing services so new APIs can be published without changing the contracts the backends already expose.

Statelessness is the decision everything else follows from. Every node runs on its own with no coordination and no centralized persistence, so there is no single point of failure and scaling out means adding instances. Configuration is declarative and versioned like any other file, putting the API lifecycle under GitOps. The project reports over 70,000 requests per second on one regular sized instance, with memory usually under 50MB at more than 1000 concurrent connections.

The feature set covers the work a gateway normally absorbs.

• Aggregation: compose, filter and merge content from several APIs into a single view.
• Transformation: rewrite responses and convert between XML and JSON in either direction.
• Security: zero trust policy, CORS, OAuth, JWT, HSTS, clickjacking protection and XSS protection.
• Rate limiting: throttle in the router and proxy layers, with bursting, load balancing and a circuit breaker.
• Telemetry: report to Datadog, Zipkin, Jaeger, Prometheus and Grafana.
• Extensibility: add behavior with Go plugins, Lua scripts, Martian or Google CEL expressions.

Distribution is by package or official Docker image, so a running gateway is one container and one configuration file away, and cloning the repository is only needed to build the binary yourself. It runs the same on Kubernetes or on hardware in your own rack, and deliberately leaves telemetry backends and identity providers to the tools you already have.

Gravitee API Management gives an organization one place to decide who reaches its APIs, when, and on what terms. It covers the whole lifecycle, from registering an API in a few clicks to documenting it, publishing it and watching the traffic that arrives at it.

A deployment is made of a gateway, an administrative console, a developer portal and a backend serving both interfaces. The quick setup in the repository starts all four next to a MongoDB database through Docker Compose or a make target, and Helm charts cover Kubernetes. Gravitee Cloud offers the same product hosted, with a free trial.

Traffic shaping and consumer management are the core of the product.

• Policies: more than fifty prebuilt policies shape the request flows reaching the gateway.
• Plans: rate limits, quotas and security rules are defined per plan and attached to an API.
• Developer portal: a catalog with a custom theme, full text search and API documentation.
• Analytics: ready-made dashboards, custom ones, and metrics exported to Grafana or Kibana.
• Applications: consumers register applications, with dynamic client registration linking to access management.

The local Docker setup exposes the portal, console, gateway and backend on separate ports behind default admin credentials that should be changed immediately. An enterprise license, supplied as a file or a base64 environment variable, unlocks the commercial features layered on the open source distribution.