A team choosing an API platform is also choosing where traffic runs, who operates it, and how much management it needs. Kong Gateway, AWS API Gateway, and Apigee serve different roles, so the best choice depends on your architecture and the work your team can own.
This comparison looks at deployment, performance, capabilities, security, pricing, and operational fit. The right choice can affect vendor lock-in, engineering effort, and how well your APIs support the business as needs change.
There is no single winner for every set of use cases. A serverless workload built around AWS may call for a different platform than a multi-cloud service or a governed partner API program.
The right fit is the one that matches the team’s existing architecture and the work it can realistically own.
Key Takeaways
- AWS API Gateway fits AWS-native serverless APIs with low gateway-management effort.
- Kong Gateway suits teams that need control over deployment and data-plane location.
- Apigee fits governed API programs that need broader management and business tools.
- Compare the full bill, including requests, environments, infrastructure, and staff time.
- Test the policies and traffic your APIs will actually use before choosing.
Kong vs AWS API Gateway vs Apigee 2026: Which fits your workload?
For a simple API already built around AWS services, AWS API Gateway is the most direct fit; Kong and Apigee are stronger when portability or broader API governance matters. Workload first is a useful way to compare these platforms, rather than naming one winner for every team.
AWS API Gateway favors AWS-native serverless APIs, Kong favors deployment control, and Apigee favors full-lifecycle API management. An API proxy call is a request processed by an Apigee proxy and billed under its applicable Standard or Extensible call tier.
| Platform | Operating model | Main strength | Best fit |
|---|---|---|---|
| Kong Gateway | Self-hostable; platform-agnostic | Data-plane control and plugins | Teams needing portability across cloud or local infrastructure |
| AWS API Gateway | AWS-managed, serverless | REST, HTTP, and WebSocket APIs | AWS-based applications and serverless backends |
| Apigee | Google Cloud-managed, with hybrid option | API policies, analytics, and lifecycle tools | Governed API programs with business-facing needs |
| Shared decision factors | Different ownership and billing models | Architecture, policies, and operating capacity | Teams comparing cost, cloud alignment, and governance |
The Amazon API Gateway overview describes its API types and AWS integrations. AWS API Gateway is a serverless service for REST, HTTP, and WebSocket APIs, while Kong Gateway can run on infrastructure you control.
An Apigee vs AWS API Gateway decision often turns on full-lifecycle management versus AWS-native simplicity. Apigee provides a Google Cloud API management platform with managed and hybrid options; AWS API Gateway keeps the service closely aligned with AWS.
A balanced Kong vs AWS API Gateway vs Apigee 2026 review favors AWS for straightforward AWS-native APIs, Kong for portability, and Apigee for broader governance. Each can be the practical choice when its operating model matches your workload.
Choose by where the API runs, who will operate its gateway, and how much API management the business needs.
Treat deployment and ownership as the first filters, then compare the specific policies and cost model your APIs need.
What does Kong offer beyond a basic proxy?
Kong suits teams that want to control where the gateway runs and extend its behavior through plugins. Modular control lets teams add gateway functions as their services need them.
Kong Gateway is built on NGINX and can be self-hosted across different infrastructure environments. Kong Gateway OSS is free to download and run, but it does not include every management or enterprise feature.
What the open-source gateway includes
Plugins can extend routing, authentication, rate limiting, and request or response transformations. This lets an engineering team choose the behavior it needs instead of relying on one fixed feature set.
The free OSS version has listed limits: it lacks Kong Manager, advanced analytics, OIDC authentication, and enterprise plugins. Teams may need other tools for those tasks or a paid tier that includes them.
Kong lists routing for AI requests across OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure AI, Databricks, Mistral, and Hugging Face. It also lists more than 60 AI features, but that does not mean every feature comes with OSS.
Teams building model access can review this Mistral API setup guide when planning provider routes and credentials. Endpoint features and request rules can differ by provider.
How Konnect and the operator change day-to-day work
Kong Konnect Plus is listed at about $105 per month per gateway service, including 1 million requests per service. Each extra million requests is listed at $200.
Kong Operator manages Kubernetes-based deployment, upgrades, and downgrades. It also supports autoscaling and rolling-restart or blue/green data-plane upgrades.
That operator can help teams that already use Kubernetes workflows, though it does not remove the need to plan capacity and own the platform. An ingress controller role may also fit into a Kubernetes setup, depending on how the team routes traffic.
Before choosing OSS, check whether the missing management, analytics, identity, or enterprise-plugin capabilities are already covered elsewhere in your stack.
How does AWS API Gateway price requests and cache use?
AWS API Gateway’s entry-level request charge is lowest for HTTP APIs, while REST and WebSocket use different billing units. API type matters because the published request rates are not the same for each one.
In 2026, HTTP API calls cost $1.00 per million, compared with $3.50 per million REST calls at the entry rate. REST pricing tiers down to $2.38 per million at high volume.
| API type | Published request unit | Rate |
|---|---|---|
| REST | Per 1 million calls | $3.50, tiering down to $2.38 at high volume |
| HTTP | Per 1 million calls | $1.00 |
| WebSocket | Per 1 million messages | $1.00 |
REST, HTTP, and WebSocket request rates
REST APIs offer a wider set of API management features than HTTP APIs, while HTTP APIs provide a simpler option for many common API needs. WebSocket APIs bill messages, which suits real-time, two-way communication.
Estimate expected request or message volume by API type. REST call pricing changes at higher volume, so a single entry rate can overstate the cost of a large workload.
Data transfer and optional caching
Data transfer out costs $0.09 per GB. Optional caching is billed hourly, so cache use adds a separate charge alongside API requests.
The AWS API bill also depends on traffic profile and region. For example, an API that sends more data out or keeps a cache running longer will add those charges to its request cost.
A cache can change how often requests reach a backend, but its hourly charge still belongs in the estimate. Include the cache size and hours that match your planned use.
Estimate each API type separately and add data transfer and any cache hours before comparing bills.
What does Apigee Pay-as-you-go cost in 2026?
Apigee Pay-as-you-go combines environment charges with call charges, and Extensible calls cost more per million than Standard calls in every listed band. Both parts count when estimating the monthly bill.
An API proxy call is a request processed by an Apigee proxy and billed as Standard or Extensible. The call category affects the rate, while the environment tier sets a separate regional charge and capacity level.
| Monthly call band | Standard calls per million | Extensible calls per million | Boundary |
|---|---|---|---|
| First 50 million | $20 | $100 | Up to 50 million calls |
| 50 million to 500 million | $16 | $80 | Above 50 million through 500 million |
| Above 500 million | $13 | $64 | More than 500 million calls |
Standard and Extensible proxy-call tiers
The call rates apply to different proxy-call categories, not to every request in the same way. Your proxy configuration determines whether a call falls under Standard or Extensible billing.
For example, each million calls in the first band costs $20 for Standard or $100 for Extensible. The rates fall in later bands, but Extensible remains higher in each one.
Environment tiers, capacity, and add-ons
Base environments cost $365 per month per region. Each supports up to 20 Standard API proxies and 50 queries per second, or QPS, but supports Standard proxies only.
Intermediate environments cost $1,460 per month per region. They support up to 50 API proxies or shared flows and up to 100 QPS, with both Standard and Extensible proxies.
Comprehensive environments cost $3,431 per month per region and allow up to 100 API proxies or shared flows. Extra proxy or shared-flow deployments cost $0.04 per hour per region.
Apigee Pay-as-you-go charges for active environments per region, API proxy calls, and proxy deployment units. Network charges also depend on where traffic starts and ends.
Price the required environment tier and regions first, then apply the correct proxy-call category and account for deployment units.
Where do the three gateways run, and who operates them?
AWS API Gateway minimizes gateway infrastructure work inside AWS, while Kong gives the team more control over where the data plane runs. Control plane means the management layer; the data plane processes API traffic.
AWS API Gateway is a fully managed, AWS-only service, while Kong Gateway can run on Kubernetes or other infrastructure. That difference shapes cloud alignment, staffing needs, and vendor lock-in.
Managed AWS and Google Cloud control planes
AWS runs the gateway service inside its cloud, so your team does not manage gateway servers. Its operations still include API configuration, monitoring, and account-level service planning.
Apigee X is managed on Google Cloud. Apigee hybrid keeps its control plane on Google Cloud while running the runtime in Kubernetes, which gives teams a different place to process traffic.
Apigee Comprehensive environments can deploy across regions. The stated service-level agreement, or SLA, is up to 99.9% in one region or 99.99% in two regions.
A team weighing these choices alongside broader cloud commitments may find this cloud platform comparison useful for its operating and cost factors.
Self-hosted and hybrid data planes
Kong’s self-hostable model lets you choose where the data plane runs, including Kubernetes or other infrastructure. That flexibility also means your team takes on infrastructure work, such as scaling and upgrades.
Before selecting a model, check these three parts of the design:
- Cloud alignment: does the platform match the services already in use?
- Data-plane placement: where must API traffic enter and run?
- Operations: who handles gateway upgrades and scaling?
Each model splits control and traffic processing differently. The answer affects both daily operations and where sensitive requests are handled.
Confirm the location of both control and data planes against the organization’s data-residency and cloud-governance requirements.
Which platform has the strongest performance evidence?
Kong’s 2024 Gateway 3.6 benchmark reports high throughput in both a basic proxy test and a more configured test. Those results show what Kong measured, not a universal ranking across gateways.
The basic test reached 137,850.4 requests per second with 3.82 milliseconds of 95th-percentile latency. The second test sustained 96,289.6 requests per second with 100 routes and 100 consumers, using rate limiting and key authentication.
The 95th percentile is the point at which 95% of measured requests finished at or below the reported latency. That measure helps show slower requests that an average can hide.
Both figures come from Kong’s own Gateway 3.6 benchmark. They describe those test configurations, and should not be treated as a direct comparison with AWS API Gateway or Apigee.
Hardware, configuration, enabled policies, payload size, and test method can change throughput and latency. A basic proxy test leaves out work that may matter in a production API.
For a fair comparison, use the same backend and test traffic on each platform. Keep authentication, rate limiting, payload size, and request mix consistent.
A team with many microservices may care more about tail latency under its real policy chain than a high request count in a stripped-down setup. The test should reflect those needs.
Record both response time and sustained throughput under expected and peak load. Include retries and backend behavior if those will shape the live path.
Run a like-for-like proof of concept with the same backend, authentication, rate limits, and request mix before making performance a deciding factor.
Which API capabilities matter for your application?
A serverless AWS application can use API Gateway’s native service integrations, while a team assembling custom gateway behavior may prefer Kong’s plugin model. Start with the API style and the work your backend needs.
Apigee offers built-in proxy policies and API management tools, while Kong adds gateway behavior through plugins. The best fit depends on whether your team values an integrated policy model or a modular one.
REST, HTTP, WebSocket, and other API styles
AWS API Gateway supports REST, HTTP, and WebSocket APIs. REST APIs suit managed API needs with broader features, HTTP APIs suit lighter common use cases, and WebSocket APIs support two-way live connections.
Its integrations with AWS Lambda, IAM, and CloudWatch can reduce custom work for an AWS-based application. These native services can be useful for serverless backends and APIs that already rely on AWS.
Apigee provides programmable API proxies and policy-based security, traffic management, and analytics. It also includes a developer portal and API monetization functions for teams that manage APIs as business products.
Policy depth versus modular extensions
Kong plugins support routing, load balancing, health checks, authentication, rate limiting, and request or response transformation. Those are common gateway functions for microservices and can be assembled around the needs of each service.
Policy breadth is not the only question. Consider who will own the configuration, how shared rules reach each API, and whether a platform’s integrations match the backend.
For an API that uses Mistral, provider routes and endpoint features can vary. A practical guide to Mistral API access can help frame how credentials and requests fit into an integration plan.
Check these four capability areas before testing:
- API protocol: REST, HTTP, WebSocket, or another required style.
- Backend integration: AWS Lambda, microservices, or external services.
- Required policy: authentication, traffic rules, or transformations.
- Configuration ownership: the team that maintains gateway behavior.
Map each required capability to the exact API type and policy configuration the team will deploy.
How do security and rate limiting differ?
The security fit depends on whether the team wants AWS-native identity, plugin-configured controls, or centralized API policies. Identity design first helps prevent teams from treating a gateway feature as a full security plan.
AWS API Gateway integrates with IAM and Cognito, Kong applies controls through plugins, and Apigee uses policies. Each model can support access and traffic rules, but the team owns different parts of setup and upkeep.
Identity and access controls
AWS API Gateway can use IAM, Cognito, API keys, and authorizers. IAM and Cognito can fit applications that already use AWS identity services.
Kong applies security behavior through gateway plugins. Apigee uses policy-based security and traffic management across API proxies.
API keys can help identify or meter clients, but an API key alone does not prove who a user is or what that user may access. Build an authorization design around the data and actions each API exposes.
Traffic protection and policy ownership
Rate limiting can protect a backend from bursts or overly frequent calls. Your design should account for where limits are set and how they apply when traffic reaches multiple gateway instances.
Apigee Advanced API Security costs $350 per 1 million API calls in 2026 and is available only with Intermediate or Comprehensive environments. That eligibility affects the environment choice as well as the add-on budget.
A security review can cover four concrete points:
- Identity provider: which service authenticates users and clients?
- Key or token handling: how are secrets issued, stored, and rotated?
- Distributed rate limiting needs: should limits apply across gateway instances?
- Policy ownership: which team reviews and updates access rules?
Test denied requests and rate-limit behavior as well as successful calls, especially across multiple gateway instances.
What do analytics, portals, and monetization add?
A partner API program needs more than traffic routing if teams must publish products, track usage, and support external developers. Business-facing tools matter when APIs serve partners or customers outside the engineering team.
Apigee combines API analytics, a developer portal, and monetization tools within its broader management platform. Those features can help when an organization treats APIs as products with users and business goals.
Usage insight and business reporting
Apigee API Analytics costs $20 per 1 million API calls in 2026 and is available only with Intermediate or Comprehensive environments. That makes the feature’s rate and environment eligibility part of planning.
AWS offers operational visibility through AWS tools, including CloudWatch, but its developer portal feature is more limited. That may be enough when the main need is observing internal API operations.
Kong Konnect Enterprise is the listed tier required for SSO, audit logs, custom service-level agreements, and dedicated support. Its pricing is custom, so those needs should be matched to the actual offer under consideration.
API discovery and partner onboarding
An integrated portal can give developers a place to find APIs and learn how to use them. This can reduce friction when partners need access to several API products.
Monetization tools can support API programs that need to tie usage to business models. They do not replace a clear product plan, but they can make business reporting and access workflows easier to manage.
Choose a fuller API management platform when teams need consistent partner onboarding, usage reports for business owners, or monetization across a larger portfolio. A smaller internal API may not need that layer.
Verify whether portal hosting, analytics, and partner workflows are included in the plan your organization would actually buy.
Which AWS API Gateway limits should you check before scaling?
The standard default throttle is 10,000 requests per second per Region, but some listed Regions start at 2,500 and other account quotas are much lower. Region and quota type both matter when sizing an API.
The 10 requests per second total-operations quota is separate from the general request throttle and cannot be increased. It has a burst quota of 40, while the general throttle has separate sustained and burst settings.
| Constraint | Default or maximum | Increase path | Applies to |
|---|---|---|---|
| Throughput and burst | 10,000 requests/second, burst 5,000; 2,500 and 1,250 in listed Regions; total operations 10/second, burst 40 | Throttle can be raised; total operations and burst quota cannot | Account per Region |
| Payload and timeout | REST payload 10 MB; timeout 50 milliseconds to 29 seconds | Payload cannot; Regional and private timeouts can, edge-optimized cannot | REST APIs |
| API and key quotas | 600 Regional REST; 120 edge-optimized REST; 600 private REST; 10,000 API keys | These quotas cannot be raised | Per Region or account per Region |
| Cache, usage plan, and VPC link | Cache TTL up to 3,600 seconds; 300 usage plans; 20 VPC links | Cache has no higher bound; usage plans and VPC links can be raised | Account per Region |
Throughput, payload, and integration timeouts
The 2,500 requests-per-second default applies to listed Regions, including Canada West (Calgary) and Mexico (Central). It is not the general default across all Regions.
REST payloads cannot exceed 10 MB. REST integration timeouts range from 50 milliseconds to 29 seconds, but only Regional and private API limits can be increased.
Regional API, key, cache, and VPC quotas
Regional REST APIs have a quota of 600 per Region, edge-optimized REST APIs have 120 per Region, and private REST APIs have 600 per account per Region. The API key quota is 10,000 per account per Region.
REST cache TTL defaults to 300 seconds and can be set as high as 3,600 seconds. Usage plans are limited to 300 per account per Region, and VPC links to 20; both quotas can be increased.
AWS explains that teams can request a higher account-level throttle, while burst capacity is not raised. Throttled callers may need retries with jittered backoff rather than repeated immediate requests.
Check the specific Region and endpoint type before designing around an increaseable default or an unchangeable maximum.
How should you compare total cost of ownership?
Total cost of ownership includes the platform bill and the labor and infrastructure needed to operate the chosen design. The full cost depends on how each gateway bills and how much work your team takes on.
These models bill different units, so compare them using the same traffic, environment, and availability scenario. AWS API Gateway charges for requests and data transfer; Apigee combines environments, proxy calls, deployments, and network charges.
A 2026 Apigee example with one Base environment, 15 Standard proxies, and 500,000 Standard calls estimates a $413 monthly total, including estimated network charges.
A second 2026 example with three Intermediate environments and 25 million monthly calls estimates $6,161 per month, including estimated network charges. The calls include 10 million Standard and 15 million Extensible calls.
Kong OSS has no download fee, but the team still pays for the infrastructure and operational work it chooses to run. A managed service shifts more runtime responsibility to the vendor, while a self-hosted gateway leaves more of that work with your team.
Use these five cost buckets to build a comparable estimate:
- Licensing or request charges: service fees, call rates, or usage bills.
- Gateway infrastructure: compute, storage, and related hosting.
- Network transfer: data moving between clients, gateways, and backends.
- Add-ons and support: paid features, service levels, and assistance.
- Engineering operations: upgrades, monitoring, incident response, and scaling.
The same traffic can create different bills because each platform counts usage differently. Include peak periods and regional needs, not only an average month.
Build the same traffic and availability scenario for all three platforms before comparing year-one budgets.
Which open-source alternatives are worth evaluating?
Teams comparing Kong API gateway alternatives open source can evaluate Envoy Gateway when its policy and Kubernetes-oriented capabilities match their needs. Fit the operator too, not just the feature list.
Envoy Gateway v1.8.0 adds traffic controls, GeoIP authorization, extension options, and telemetry settings. Those additions make it worth testing for teams whose workloads need those specific functions.
Where Envoy Gateway fits
Version 1.8.0 adds BackendRef traffic-splitting weights. It also adds shadow mode for local and global rate limits, allowing teams to assess those policies without applying them as normal enforcement.
BackendTrafficPolicy adds retry-budget and bandwidth-limiting support. SecurityPolicy adds GeoIP-based authorization for HTTPRoute and GRPCRoute, giving teams more options for route-level access rules.
Envoy Dynamic Modules and sequential chaining of multiple ExtensionManagers add ways to extend gateway behavior. OpenTelemetry support adds sampler configuration and custom headers on OTLP exports for metrics, tracing, and access logs.
What an alternative must prove
Feature presence does not establish parity with a full API management platform. A gateway can support detailed traffic policies and still lack the wider business tools an API program needs.
Compare an alternative on the work your team will maintain:
- Required integrations: can it connect to your backends and identity systems?
- Policy coverage: can it enforce the rules your APIs need?
- Release and upgrade effort: can the team keep versions current?
- Operational ownership: who runs it during normal work and incidents?
Test the operator workflow and policy behavior in the deployment environment the team will actually maintain.
A feature list is a starting point, not proof that an open-source gateway fits the whole API program.
Which platform should your team choose?
For a simple API already built around AWS services, AWS API Gateway is the most direct starting choice. Choose around ownership as well as API features, since each platform gives the team a different operating role.
AWS API Gateway is the direct fit for a basic AWS-native API; Kong and Apigee win when their specific strengths matter more. AWS Lambda and IAM are examples of native AWS integrations.
Use these options to form a shortlist:
- Choose AWS API Gateway for AWS-native serverless APIs and minimal gateway operations.
- Choose Kong for self-hosting, multi-cloud flexibility, and data-plane control.
- Choose Apigee for governed API programs needing analytics, portal functions, and monetization, if Google Cloud control-plane ties fit your needs.
Apigee hybrid can place its runtime in Kubernetes, but its control plane remains on Google Cloud. That distinction matters to teams with cloud governance or data-residency rules.
Shortlist the option that matches the team’s cloud and operating model, then validate it with a workload-specific proof of concept.
Conclusion
The safest choice is the platform your team can operate confidently while meeting its API program’s real requirements. Current cloud commitments and operating capacity should shape the choice as much as feature needs.
A proof of concept can reveal whether traffic handling, policies, and regional design work as expected. Model a realistic request mix and include the people and infrastructure needed to keep the gateway running.
Test the leading candidate against a real API, its expected traffic, and the policies the team must enforce before making a purchase.
FAQ
Can AWS API Gateway handle more than 10,000 requests per second?
Yes, AWS can raise the default account throttle of 10,000 requests per second per Region, but burst capacity is separate and cannot be raised. Some listed Regions start at 2,500 requests per second with a burst quota of 1,250. The 10,000 figure describes the general throttle, not every Region or every API’s usable capacity.
Does Apigee hybrid run entirely outside Google Cloud?
No, Apigee hybrid does not run entirely outside Google Cloud. Its runtime can run in Kubernetes, but its control plane remains on Google Cloud. That split lets a team place traffic processing in its Kubernetes environment while keeping management tied to Google Cloud. Account for both locations when reviewing cloud governance or data-residency rules.
What is the difference between AWS REST and HTTP API pricing?
In 2026, AWS REST API calls cost $3.50 per million at the entry rate, tiering down to $2.38 at high volume; HTTP API calls cost $1.00 per million. The two API types also differ in features, so the lower HTTP rate does not make it a match for every REST workload. Estimate each type using its own expected volume.
Does Kong Gateway OSS include Kong Manager and OIDC authentication?
No, Kong Gateway OSS does not include Kong Manager or OIDC authentication among its listed capabilities. OSS is free to download and self-host, while management and advanced identity features may require other tools or a paid tier. Check the exact features your team needs before treating the download price as the full operating cost.
Can AWS API Gateway extend a REST integration timeout beyond 29 seconds?
Sometimes: Regional and private REST API timeout limits may be increased, but edge-optimized REST API limits cannot. The standard REST integration timeout range is 50 milliseconds to 29 seconds. A longer backend task may need a different design, such as returning a job identifier and letting the client check for completion.
Is Apigee API Analytics included with every environment tier?
No, Apigee API Analytics is available only with Intermediate or Comprehensive environments. In 2026, it costs $20 per 1 million API calls. Base environments do not qualify, so teams need to include both the eligible environment tier and analytics usage when estimating the cost of reporting.
