What are the alternatives to Portkey? First decide whether you need one. Palo Alto Networks completed its acquisition of Portkey on 29 May 2026 and made it the core gateway of its Prisma AIRS AI security platform1; Portkey's pricing page now says "Portkey is now PRISMA AIRS AI Gateway, generally available for all enterprises"2. If securing what models receive and return is your requirement, that is a reason to stay. If you chose Portkey as a developer gateway for routing, observability and cost, compare: Portkey's own open-source gateway, LiteLLM or Bifrost to self-host; Cloudflare or Vercel AI Gateway on a platform you already use; Langfuse for observability and prompts; and a BYOK control plane such as INFRO for budgets and attribution on your own provider accounts.
What changed, factually
- Ownership. Palo Alto Networks announced the completed acquisition on 29 May 2026, positioning Portkey as the gateway for its AI security platform1.
- Product name and tiers. Portkey's pricing page lists Open Source (host it yourself), Developer, Production and Enterprise, and places role-based access control, SSO and granular budgets and rate limits under Enterprise's governance features2.
- The open-source gateway. Still on GitHub under the MIT license, runnable with
npx @portkey-ai/gateway, Docker, Node.js or Cloudflare Workers, with fallbacks, automatic retries, load balancing across keys or providers, guardrails on inputs and outputs, and response caching3.
An acquisition by a strong company is not a problem in itself. What matters is whether the product's direction — now clearly security — is your direction, and whether the controls you rely on sit in the tier you buy.
Stay, or move?
| If your priority is… | Then |
|---|---|
| Runtime AI security, PII redaction, content controls on prompts and responses | Stay; this is the product's centre now |
| You already standardise on Palo Alto Networks | Stay; one vendor, one procurement cycle |
| A self-hosted gateway with no agreement | Portkey's OSS gateway, LiteLLM or Bifrost |
| A free or low-cost hosted gateway on your platform | Cloudflare or Vercel AI Gateway |
| Prompt management and evaluation | Langfuse |
| Budgets and cost attribution on your own provider accounts at your entry plan | A BYOK control plane |
The alternatives
Portkey's open-source gateway
The lowest-change option for teams that liked Portkey's routing: the same project, self-hosted. You get fallbacks, retries, load balancing, guardrails and caching3; you take on operating, patching and securing it, and the organisation features of the hosted product (budgets, RBAC, SSO) are not part of it.
LiteLLM
A self-hosted, OpenAI-compatible gateway for more than 100 providers, with virtual keys carrying their own models, budgets and rate limits, spend tracking by key, team, user and tag, load balancing, fallbacks, guardrails and logging integrations, deployed against Postgres4. The most widely used open-source choice; LiteLLM alternatives covers its 2026 supply-chain incident and the controls any self-hosted gateway needs.
Bifrost
Apache 2.0, with automatic failover, load balancing across keys and providers, virtual keys with hierarchical budgets and rate limits, semantic caching, an MCP gateway and Prometheus metrics with tracing5. A good fit if you want budgets and an MCP gateway in a self-hosted package.
Cloudflare AI Gateway
Free core features on a Cloudflare account, and dollar spend limits scoped by provider, model or metadata that apply to BYOK traffic for models with known pricing, returning 429 at the cap or moving traffic to a fallback model6. The natural choice if your traffic already runs through Cloudflare.
Langfuse
If you used Portkey mostly for its logs, prompt library and evaluation, Langfuse is the closer match: open-source tracing, prompt management with versions and labels, LLM-as-a-judge and human evaluation, and cost per user, self-hostable7. It records rather than routes, so pair it with a gateway if you need one.
INFRO, a BYOK control plane
INFRO is a hosted gateway on provider accounts you connect, charging a subscription with 0% markup on model spend. Its organisation controls are on every plan rather than in an enterprise tier: budgets that refuse a request before the provider is called at organization, project, member and key level, model allowlists at organization, project and key level, and an audit log; negotiated rates and end-customer caps come with the Team plan, and SSO, SCIM, guardrails and reconciliation against OpenAI's and Anthropic's cost APIs with Business. Its guardrails are pattern checks plus prompt classifiers, narrower than a security platform's, and it has no prompt management — if those are your requirements, stay with Prisma AIRS or add Langfuse.
How to evaluate the move
- List what you use. Routing configs, virtual keys, budgets, guardrails, prompt templates, logs. Each maps to a different destination.
- Check your contract. Know your renewal date and what the Enterprise tier would cost you for the controls you need.
- Export logs and prompts. Keep a copy you control before changing anything.
- Pilot with real traffic. Put one service on the candidate behind a flag for a week, compare errors, latency and cost per request, then decide. Migrating from direct calls to a gateway has the canary steps.
Summary
Portkey is now a security product inside Palo Alto Networks. Stay if that is what you are buying. If you chose it for developer routing, observability or cost control, its open-source gateway, LiteLLM, Bifrost, Cloudflare, Langfuse and BYOK control planes each cover one of those jobs; pick by the job, and keep your provider accounts in your own name so the next change of ownership in this market costs you a base URL, not a migration.