# Portkey alternatives in 2026, after Prisma AIRS

URL: https://infro.io/blog/portkey-alternatives-2026
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-10-20
Last modified: 2026-10-20
Last reviewed: 2026-10-20 (next review due 2026-11-19)
Topic: Architecture and migration
Format: Comparison

> Palo Alto Networks completed its acquisition of Portkey on 29 May 2026, and Portkey's pricing page now says Portkey is Prisma AIRS AI Gateway, generally available for all enterprises, with role-based access, SSO and granular budgets listed on Enterprise. Stay if runtime AI security is your requirement. Otherwise choose by need: Portkey's own MIT gateway, LiteLLM or Bifrost to self-host; Cloudflare or Vercel AI Gateway for a hosted gateway on a platform you use; Langfuse for observability and prompt management; a BYOK control plane such as INFRO for budgets and attribution on your own provider accounts.

Key takeaways:
- Palo Alto Networks completed its acquisition of Portkey on 29 May 2026; the hosted product is now Prisma AIRS AI Gateway.
- If runtime AI security is the requirement, stay: it now sits inside a security company's platform.
- Portkey's open-source gateway is still MIT licensed and self-hostable, with fallbacks, retries, load balancing, guardrails and caching.
- Portkey's pricing page lists granular budgets and rate limits, RBAC and SSO on Enterprise; check where the controls you need sit.
- Choose an alternative by job: self-hosting, a platform gateway, observability, or spend control on your own provider accounts.

**What are the alternatives to Portkey?** First decide whether you need one. Palo Alto Networks completed its acquisition of Portkey on 29 May 2026 and made it the core gateway of its Prisma AIRS AI security platform[1]; Portkey's pricing page now says "Portkey is now PRISMA AIRS AI Gateway, generally available for all enterprises"[2]. If securing what models receive and return is your requirement, that is a reason to stay. If you chose Portkey as a developer gateway for routing, observability and cost, compare: Portkey's own **open-source gateway**, **LiteLLM** or **Bifrost** to self-host; **Cloudflare** or **Vercel AI Gateway** on a platform you already use; **Langfuse** for observability and prompts; and a **BYOK control plane** such as INFRO for budgets and attribution on your own provider accounts.

## What changed, factually

- **Ownership.** Palo Alto Networks announced the completed acquisition on 29 May 2026, positioning Portkey as the gateway for its AI security platform[1].
- **Product name and tiers.** Portkey's pricing page lists Open Source (host it yourself), Developer, Production and Enterprise, and places role-based access control, SSO and granular budgets and rate limits under Enterprise's governance features[2].
- **The open-source gateway.** Still on GitHub under the MIT license, runnable with `npx @portkey-ai/gateway`, Docker, Node.js or Cloudflare Workers, with fallbacks, automatic retries, load balancing across keys or providers, guardrails on inputs and outputs, and response caching[3].

An acquisition by a strong company is not a problem in itself. What matters is whether the product's direction — now clearly security — is your direction, and whether the controls you rely on sit in the tier you buy.

## Stay, or move?

| If your priority is… | Then |
| --- | --- |
| Runtime AI security, PII redaction, content controls on prompts and responses | Stay; this is the product's centre now |
| You already standardise on Palo Alto Networks | Stay; one vendor, one procurement cycle |
| A self-hosted gateway with no agreement | Portkey's OSS gateway, LiteLLM or Bifrost |
| A free or low-cost hosted gateway on your platform | Cloudflare or Vercel AI Gateway |
| Prompt management and evaluation | Langfuse |
| Budgets and cost attribution on your own provider accounts at your entry plan | A BYOK control plane |

## The alternatives

### Portkey's open-source gateway

The lowest-change option for teams that liked Portkey's routing: the same project, self-hosted. You get fallbacks, retries, load balancing, guardrails and caching[3]; you take on operating, patching and securing it, and the organisation features of the hosted product (budgets, RBAC, SSO) are not part of it.

### LiteLLM

A self-hosted, OpenAI-compatible gateway for more than 100 providers, with virtual keys carrying their own models, budgets and rate limits, spend tracking by key, team, user and tag, load balancing, fallbacks, guardrails and logging integrations, deployed against Postgres[4]. The most widely used open-source choice; [LiteLLM alternatives](https://infro.io/blog/litellm-alternatives-2026) covers its 2026 supply-chain incident and the controls any self-hosted gateway needs.

### Bifrost

Apache 2.0, with automatic failover, load balancing across keys and providers, virtual keys with hierarchical budgets and rate limits, semantic caching, an MCP gateway and Prometheus metrics with tracing[5]. A good fit if you want budgets and an MCP gateway in a self-hosted package.

### Cloudflare AI Gateway

Free core features on a Cloudflare account, and dollar spend limits scoped by provider, model or metadata that apply to BYOK traffic for models with known pricing, returning 429 at the cap or moving traffic to a fallback model[6]. The natural choice if your traffic already runs through Cloudflare.

### Langfuse

If you used Portkey mostly for its logs, prompt library and evaluation, Langfuse is the closer match: open-source tracing, prompt management with versions and labels, LLM-as-a-judge and human evaluation, and cost per user, self-hostable[7]. It records rather than routes, so pair it with a gateway if you need one.

### INFRO, a BYOK control plane

INFRO is a hosted gateway on provider accounts you connect, charging a subscription with 0% markup on model spend. Its organisation controls are on every plan rather than in an enterprise tier: budgets that refuse a request before the provider is called at organization, project, member and key level, model allowlists at organization, project and key level, and an audit log; negotiated rates and end-customer caps come with the Team plan, and SSO, SCIM, guardrails and reconciliation against OpenAI's and Anthropic's cost APIs with Business. Its guardrails are pattern checks plus prompt classifiers, narrower than a security platform's, and it has no prompt management — if those are your requirements, stay with Prisma AIRS or add Langfuse.

## How to evaluate the move

1. **List what you use.** Routing configs, virtual keys, budgets, guardrails, prompt templates, logs. Each maps to a different destination.
2. **Check your contract.** Know your renewal date and what the Enterprise tier would cost you for the controls you need.
3. **Export logs and prompts.** Keep a copy you control before changing anything.
4. **Pilot with real traffic.** Put one service on the candidate behind a flag for a week, compare errors, latency and cost per request, then decide. [Migrating from direct calls to a gateway](https://infro.io/blog/migrate-direct-openai-to-gateway-canary) has the canary steps.

## Summary

Portkey is now a security product inside Palo Alto Networks. Stay if that is what you are buying. If you chose it for developer routing, observability or cost control, its open-source gateway, LiteLLM, Bifrost, Cloudflare, Langfuse and BYOK control planes each cover one of those jobs; pick by the job, and keep your provider accounts in your own name so the next change of ownership in this market costs you a base URL, not a migration.

## Questions

### Is Portkey still available?

Yes. Palo Alto Networks completed its acquisition on 29 May 2026 and Portkey's hosted gateway now ships as Prisma AIRS AI Gateway, which Portkey's pricing page describes as generally available for all enterprises. Portkey's open-source gateway remains on GitHub under the MIT license.

### What is the best open-source alternative to Portkey?

Portkey's own open-source gateway is still available. Other self-hosted options are LiteLLM, an OpenAI-compatible proxy for more than 100 providers with virtual keys and budgets, and Bifrost, an Apache-2.0 gateway with hierarchical budgets and an MCP gateway.

### Portkey or LiteLLM?

Both have open-source gateways you can run yourself. LiteLLM's proxy documents virtual keys with budgets, spend tracking by key, team, user and tag, and many logging integrations. Portkey's open-source gateway documents fallbacks, retries, load balancing, guardrails and caching, while its budgets, RBAC and SSO sit in the hosted Enterprise tier.

## Sources

1. Palo Alto Networks Completes Acquisition of Portkey to Secure AI Agents — Palo Alto Networks. https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-portkey-to-secure-ai-agents (accessed 2026-10-20)
2. Pricing — Portkey. https://portkey.ai/pricing (accessed 2026-10-20)
3. Portkey-AI/gateway — GitHub. https://github.com/Portkey-AI/gateway (accessed 2026-10-20)
4. LiteLLM AI Gateway (proxy server) — LiteLLM. https://docs.litellm.ai/docs/simple_proxy (accessed 2026-10-20)
5. maximhq/bifrost — GitHub. https://github.com/maximhq/bifrost (accessed 2026-10-20)
6. Spend limits — Cloudflare. https://developers.cloudflare.com/ai-gateway/features/spend-limits/ (accessed 2026-10-20)
7. Langfuse documentation — Langfuse. https://langfuse.com/docs (accessed 2026-10-20)