# Best AI gateways in 2026: which one fits which team

URL: https://infro.io/blog/best-ai-gateways-2026
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-10-20
Last modified: 2026-10-20
Last reviewed: 2026-10-20 (next review due 2026-11-19)
Topic: Architecture and migration
Format: Comparison

> The best AI gateway depends on your constraint. To self-host open source, look at LiteLLM, Bifrost or Portkey's open-source gateway. To start free on a platform you already use, Cloudflare AI Gateway or Vercel AI Gateway. For the broadest catalog on one balance, OpenRouter. If you run Kong, Kong AI Gateway. For security-first governance, Prisma AIRS AI Gateway (formerly Portkey). For spend control and attribution across your own provider accounts with no markup on model spend, a BYOK control plane such as INFRO. Helicone closed new sign-ups in March 2026.

Key takeaways:
- Decide on three questions first: who runs the gateway, whose provider accounts carry the traffic, and whether its limits act before the provider is called.
- Self-hosted and open source: LiteLLM, Bifrost, Portkey's open-source gateway, Kong. You operate it, and its supply chain is yours.
- Free to start on a platform you already use: Cloudflare AI Gateway, Vercel AI Gateway.
- Broadest catalog on one balance: OpenRouter. Security-first: Prisma AIRS AI Gateway. Spend control across your own accounts: a BYOK control plane.
- Check BYOK fallback and whether budgets count BYOK spend; those two answers differ more than feature lists do.

**Which AI gateway is best?** It depends on three answers: who runs the gateway, whose provider accounts carry your traffic, and whether its limits act before the provider is called. If you want open source you host yourself, look at **LiteLLM**, **Bifrost** or **Portkey's open-source gateway**. If you want free and already run on Cloudflare or Vercel, use **Cloudflare AI Gateway** or **Vercel AI Gateway**. For the largest catalog on one balance, **OpenRouter**. If your platform team runs Kong, **Kong AI Gateway**. For security-first governance, **Prisma AIRS AI Gateway**, formerly Portkey. For spend control and attribution across provider accounts you already own, with no markup on model spend, a **BYOK control plane** such as INFRO.

Below: the three questions, a comparison table, and each option described from its own documentation as of October 2026.

## The three questions that separate gateways

1. **Who runs it?** Self-hosted software you deploy, patch and secure, or a hosted service. Self-hosting keeps keys and prompts in your network and makes the release pipeline your responsibility; [LiteLLM alternatives](https://infro.io/blog/litellm-alternatives-2026) covers what the March 2026 PyPI incident taught about that.
2. **Whose provider accounts carry the traffic?** The platform's (it buys model access and bills you) or yours (BYOK, your provider bills you). Many offer both; then ask what happens when your key fails. [What is BYOK in AI](https://infro.io/blog/what-is-byok-ai) lists the questions.
3. **Do limits act before the call?** A budget that refuses a request before the provider is called controls spend; a dashboard that reports it afterwards does not. Also ask whether limits count spend on your own keys.

## The options at a glance

| Gateway | Who runs it | Provider accounts | Budgets on your own keys | Best when |
| --- | --- | --- | --- | --- |
| LiteLLM | You (open source) | Yours | Yes: key, team, user, tag | You want to self-host the default OSS gateway |
| Bifrost | You (Apache 2.0) | Yours | Yes: virtual keys | You want a self-hosted gateway with an MCP gateway built in |
| Portkey gateway (OSS) | You (MIT) | Yours | Not described in its README | You want a lightweight self-hosted router |
| Kong AI Gateway | You or Kong-hosted data planes | Yours | Cost-based limits via AI Rate Limiting Advanced | You already run Kong |
| Cloudflare AI Gateway | Cloudflare | Yours or Cloudflare's billing | Yes, for priced models | You are on Cloudflare and want free core features |
| Vercel AI Gateway | Vercel | Vercel's, or yours on paid tier | No: BYOK spend not counted | You build on Vercel and the AI SDK |
| OpenRouter | OpenRouter | OpenRouter's, or yours | Only if switched on | You want the broadest catalog on one balance |
| Prisma AIRS AI Gateway | Palo Alto Networks | Yours | Granular budgets on Enterprise | Runtime AI security is the requirement |
| INFRO | INFRO (hosted) | Only yours | Yes, every request | You need spend control and attribution across your own accounts |

Table: Summarised from each product's own pages on 2026-10-20. Products change quickly; check them on the day you decide.

## Self-hosted, open source

**LiteLLM** is a self-hosted server giving applications one OpenAI-compatible endpoint for more than 100 providers, with virtual keys carrying their own models, budgets and rate limits, spend tracking by key, team, user and tag, load balancing, fallbacks and retries, guardrails, logging integrations and an admin UI. It is deployed with Docker, Helm or Terraform against a Postgres database, with Redis sizing covered in its production guide[1]. It is the default open-source answer.

**Bifrost** is Apache 2.0, starts with `npx -y @maximhq/bifrost` or Docker, and lists automatic failover, load balancing across keys and providers, virtual keys with hierarchical budgets and rate limits, semantic caching, an MCP gateway and Prometheus metrics with tracing[2].

**Portkey's open-source gateway** remains available to self-host; Portkey's pricing page lists an Open Source tier beside its hosted tiers[3].

**Kong AI Gateway** adds AI routing to Kong Gateway: one API across major providers, failover when a provider is slow or unavailable, a semantic cache, per-request cost calculation that AI Rate Limiting Advanced can enforce spend limits against, guardrails with PII redaction, and MCP tooling, with data planes self-hosted, in the cloud or on Kubernetes and managed through Konnect[4]. If your platform team already runs Kong, it is the natural choice.

## Hosted on a platform you already use

**Cloudflare AI Gateway** offers its core features — analytics, caching and rate limiting — free with a Cloudflare account; guardrails are billed as Workers AI inference, and Unified Billing carries a 5% fee on purchases[5]. Its spend limits are dollar budgets scoped by provider, model or metadata that return 429 at the cap or move traffic to a fallback model, and they apply to BYOK requests for models with known pricing. Cloudflare is candid that cost tracking is a best-effort estimate and that a burst of concurrent requests can briefly pass a limit[6].

**Vercel AI Gateway** is built into the Vercel platform and the AI SDK. BYOK is available on its paid tier and requires purchased AI Gateway credits; when a request on your credentials fails, it is retried on Vercel's system credentials and billed to your balance; and spend through your own credentials "isn't counted in budgets"[7].

## Aggregators

**OpenRouter** sells access to a very large catalog on one balance, and also takes your own keys. On BYOK it charges 5% of what the same usage would cost on OpenRouter after a monthly allowance, falls back to its shared capacity by default when your keys fail or are rate limited, and counts BYOK spend in budgets only if you turn that on[8]. Stripe announced on 19 August 2026 that it has agreed to acquire OpenRouter[9]. [OpenRouter alternatives](https://infro.io/blog/openrouter-alternatives-2026) covers the commercial model.

## Security-first

**Prisma AIRS AI Gateway** is what Portkey's hosted gateway became under Palo Alto Networks; Portkey's pricing page states that "Portkey is now PRISMA AIRS AI Gateway, generally available for all enterprises", and lists role-based access control, SSO and granular budgets and rate limits under Enterprise[3]. If guarding what models receive and return is the requirement driving your evaluation, start there.

## A note on Helicone

Mintlify acquired Helicone on 3 March 2026 and said it would continue in maintenance mode, with security updates, bug fixes and new models, and would help every customer migrate[10]. Its sign-up page reads "Sign ups are disabled"[11]. Existing users can plan a move on their own timetable; new teams should look elsewhere.

## BYOK control planes, and where INFRO fits

INFRO is a hosted gateway and control plane that runs only on provider accounts you connect, and charges a software subscription with 0% markup on model spend. Budgets at organization, project, member and key level are checked before the provider is called and see every request, because every request is on your own keys; each request carries an estimated cost at list or negotiated rates, attributed by project, key, model, route and end customer; and on the Business plan the month's estimate is checked against OpenAI's and Anthropic's own cost APIs. It is the right choice when several teams or customers share AI spend across providers and someone has to answer for it.

It is **not** the right choice if you need to self-host without an enterprise agreement (use LiteLLM, Bifrost or Kong), want to start at zero cost (Cloudflare or a self-hosted gateway), want one balance for every model without provider accounts of your own (OpenRouter or Vercel), or need prompt management (Langfuse, which records traces beside the request rather than routing them).

## How to choose in an afternoon

1. Write down your three answers: who runs it, whose accounts, and whether limits must act before the call.
2. Strike out every option that fails one of them.
3. For the rest, read three pages each: BYOK behaviour, budgets, and pricing.
4. Run a day of real traffic through the top two, behind a flag. [From direct OpenAI calls to a gateway](https://infro.io/blog/migrate-direct-openai-to-gateway-canary) is the runbook.

## Summary

The best AI gateway is the one whose operating model, account model and enforcement point match yours. Self-hosters have strong open-source options; teams on Cloudflare or Vercel have free starting points; aggregators win on catalog; security-first buyers have Prisma AIRS; and teams that need spend control across their own provider accounts need a BYOK control plane.

## Questions

### What is the best open-source AI gateway?

The most widely used is LiteLLM, a self-hosted OpenAI-compatible proxy for over 100 providers with virtual keys, budgets, fallbacks and logging. Bifrost (Apache 2.0) and Portkey's MIT-licensed gateway are also open source. All require you to run, patch and secure the gateway yourself.

### What is the best free AI gateway?

Cloudflare AI Gateway's core features — analytics, caching and rate limiting — are free on a Cloudflare account, and Vercel AI Gateway has a free tier covering a subset of models. Self-hosted open-source gateways are free to license but cost engineering time to operate.

### Which AI gateway is best for controlling spend?

Look for budgets that refuse a request before the provider is called, that count spend on your own provider keys, and that estimate cost at your negotiated rates. Cloudflare's spend limits count BYOK traffic for priced models; Vercel's budgets do not count BYOK spend; BYOK control planes such as INFRO budget every request because every request runs on your own keys.

### Is Helicone still available?

Mintlify acquired Helicone in March 2026 and said it would continue in maintenance mode with security updates, bug fixes and new models. Its sign-up page reads 'Sign ups are disabled', so new teams cannot adopt the hosted product.

## Sources

1. LiteLLM AI Gateway (proxy server) — LiteLLM. https://docs.litellm.ai/docs/simple_proxy (accessed 2026-10-20)
2. maximhq/bifrost — GitHub. https://github.com/maximhq/bifrost (accessed 2026-10-20)
3. Pricing — Portkey. https://portkey.ai/pricing (accessed 2026-10-20)
4. Kong AI Gateway — Kong. https://developer.konghq.com/ai-gateway/ (accessed 2026-10-20)
5. AI Gateway pricing — Cloudflare. https://developers.cloudflare.com/ai-gateway/reference/pricing/ (accessed 2026-10-20)
6. Spend limits — Cloudflare. https://developers.cloudflare.com/ai-gateway/features/spend-limits/ (accessed 2026-10-20)
7. Bring Your Own Key (BYOK) to AI Gateway — Vercel. https://vercel.com/docs/ai-gateway/authentication-and-byok/byok (accessed 2026-10-20)
8. BYOK — OpenRouter. https://openrouter.ai/docs/guides/overview/auth/byok (accessed 2026-10-20)
9. Stripe agrees to acquire OpenRouter — Stripe. https://stripe.com/newsroom/news/stripe-agrees-to-acquire-openrouter (accessed 2026-10-20)
10. Mintlify acquires Helicone — Mintlify. https://www.mintlify.com/blog/mintlify-acquires-helicone (accessed 2026-10-20)
11. Helicone sign up — Helicone. https://us.helicone.ai/signup (accessed 2026-10-20)