// 8 picks · reviewed August 2026
The Best Open Source API Gateways, Compared in 2026
An API gateway sits in front of your services and handles the boring, critical stuff — auth, rate limiting, routing, TLS — so your backends don't each have to reimplement it. Reverse proxies like Caddy and Traefik cover a chunk of that too, which is why this list ranges from full plugin platforms to a web server with great TLS defaults.
What actually separates them is less about features on paper and more about three things: what language you're writing extensions in (Lua for Kong and APISIX, Go for Traefik, Tyk, Caddy and KrakenD, C++ for Envoy), whether the gateway needs a coordination store like etcd or is stateless by design, and where the open-source line gets drawn before you hit a paid tier — Kong, Tyk, and KrakenD all draw it earlier than their marketing suggests. One entry here, ingress-nginx, isn't really a contender anymore; it's retired, and it's on the list so you know to route around it, not toward it.
How we picked these
Every repo here was read and assessed on its own before it was considered for this page: we pull the README, the directory layout and a key source file, and write the assessment from those rather than from the project's own marketing. Candidates for this list came from a full-text and topic search over the 119 reviewed repositories that matched this category. Anything with no commit in the last 12 months was cut, as were link collections, tutorials and boilerplates; the floor for inclusion was 500 stars. The ordering is a judgement call about who should pick what, not a ranking by stars. finds.dev is independent of every project listed here: nobody paid for a place on this page, there are no affiliate or referral links on it, and we have no commercial relationship with any of them. That is the point of writing down what each one is bad at as well as what it is good at.
// 1 of 8
★ 43,686 · Lua · Apache-2.0 · updated Jun 2026
the most mature plugin ecosystem and widest adoption
Kong is still the default answer here, and mostly for good reason — the plugin ecosystem is the widest of anything on this list, and the phase-based execution model (access, header_filter, body_filter, log) is genuinely well designed rather than bolted together. DB-less mode with declarative YAML fits a GitOps pipeline cleanly, and the hybrid control-plane/data-plane split is a real architecture choice, not a marketing line.
The cost is Lua. Writing or debugging a plugin means learning OpenResty's cosockets and shared dictionaries, not standard Lua, and that tax applies to APISIX too — Tyk is the one gateway here that gives you the same category of feature set in Go instead. Enterprise gating is also aggressive: RBAC, Vault secrets, and real analytics are all paywalled, so the free tier runs out sooner than the docs imply.
The new AI gateway features are worth a mental asterisk — they're more nginx plugins wearing a new label, not a different request model underneath, so if your LLM traffic doesn't look like ordinary HTTP request/response, you'll fight the same architecture everyone here shares.
View on GitHub → Our full take →
// 2 of 8
★ 17,043 · Lua · Apache-2.0 · updated Aug 2026
teams wanting a faster, etcd-backed alternative to Kong
APISIX is what you pick when Kong's reload story bothers you — routes and plugins hot-reload through etcd with no worker restart, which matters a lot once you're pushing config changes daily. The plugin count is enormous and spans multiple language runtimes (Java, Go, Python) rather than Lua-only, and the AI proxy code does real protocol conversion across Anthropic, Bedrock, and OpenAI-compatible APIs instead of just labeling itself AI-ready.
The price is etcd. Kong's DB-less mode gets you to zero stateful dependencies; APISIX's standard deployment doesn't, so you're operating an extra service that Caddy or KrakenD would never ask of you. It's still Lua/OpenResty under the hood too, so the debugging tax that hits Kong hits you here.
With 100+ plugin files, several of them brand-new AI additions, you're largely on your own figuring out what's battle-tested versus recently bolted on — Apache's slower governance cadence helps with stability, but it doesn't tell you which specific plugin to trust yet.
View on GitHub → Our full take →
// 3 of 8
★ 63,638 · Go · MIT · updated Jun 2026
Docker/Kubernetes shops that want routing to follow service discovery automatically
Traefik is the right call when your infrastructure changes shape constantly — point it at Docker or Kubernetes and routing rewires itself as containers come and go, no restarts, no hand-edited nginx.conf. Automatic Let's Encrypt TLS, wildcards included, puts it in the same just-works territory as Caddy, and its middleware system is composable in a way that feels first-class rather than added on.
The v2-to-v3 migration is the scar to know about — routing syntax changed badly enough that Traefik shipped an entire guide for it, so budget for active maintenance rather than treating it as set-and-forget the way Caddy mostly is. The config surface (TOML, YAML, Docker labels, Kubernetes CRDs, env vars, all interacting) gets genuinely confusing once static and dynamic sources mix.
At high request volume, the per-request cost of dynamic middleware chains and certificate lookups shows up — this isn't a drop-in nginx replacement if raw throughput is the thing you're optimizing for.
View on GitHub → Our full take →
// 4 of 8
★ 10,739 · Go · NOASSERTION · updated Jun 2026
teams needing native GraphQL and gRPC support, not just REST
Tyk's pitch against Kong and APISIX is the extension language — Go, Python, JavaScript, or gRPC, not Lua, so you're never learning OpenResty's dialect just to write middleware. Native GraphQL and gRPC support goes further here than in Kong or Caddy, and the Kubernetes operator makes GitOps-style management real rather than a demo.
The trap is shaped like Kong's: the gateway engine is open source, but the dashboard, developer portal, and analytics beyond raw logs are all commercial, and that license lives inside the OSS repo in an 'ee' folder that will confuse anyone trying to contribute. Tests need Redis running locally, and the CI setup assumes infrastructure most teams don't have by default.
The GraphQL support is also visibly mid-migration — two engine versions coexist in the codebase — so check what you're actually running before you build on it.
View on GitHub → Our full take →
// 5 of 8
★ 73,724 · Go · Apache-2.0 · updated Jul 2026
small setups that just want reverse proxying with zero-config HTTPS
Caddy is what you reach for when you want a reverse proxy with TLS that just works and nothing else to think about — point it at a domain, CertMagic handles Let's Encrypt, renewal, and OCSP stapling. Against Traefik it's the simpler tool: no orchestrator-watching, no CRDs, just a Caddyfile.
That simplicity has a ceiling. Fine-grained control means dropping into raw JSON, which gets verbose fast — Traefik's label-based config scales to complexity better. Adding a module means recompiling with xcaddy, not dropping one in at runtime, so plan for that build step, and the admin API listens unauthenticated on localhost by default, fine on a single box and a footgun the moment your setup grows and you forget to lock it down.
If you actually need plugin-level auth, rate limiting, and transformation at the level Kong or Tyk offer, Caddy isn't building toward that — it's a web server with excellent TLS, not a gateway.
View on GitHub → Our full take →
// 6 of 8
★ 28,828 · C++ · Apache-2.0 · updated Aug 2026
platform teams building custom infra or a service mesh, not a packaged product
Envoy isn't really competing with the rest of this list — it's the thing Istio, Ambassador, and Gloo are built on top of, and you reach for it when you're building your own proxy layer or service mesh, not buying a packaged gateway. The xDS dynamic config API is close to an industry standard at this point, and the extension surface (Kafka, Postgres, MySQL, Wasm, hardware crypto offload) goes well beyond HTTP in a way nothing else here attempts.
That power is the entire cost. The Bazel-based C++ build is slow to get started with, and the config surface of protos, filter chains, and xDS resources has a learning curve that makes Kong's plugin system look easy by comparison. If what you actually need is route, rate-limit, and terminate TLS, Envoy is the wrong tool — it's infrastructure for people building infrastructure, not a Friday-afternoon deploy.
Small thing worth flagging: the repo's topic tags include things like cars and corgis, which reads as gamed GitHub metadata — harmless, but a cue to check when the project's housekeeping was last done.
View on GitHub → Our full take →
// 7 of 8
★ 19,493 · Go · Apache-2.0 · updated Mar 2026
teams fully committed to Kubernetes-native ingress
Put simply: don't start here. ingress-nginx is officially retired — no new features, no bugfixes, and no security patches after March 2026, so any CVE found after that date stays open in your cluster indefinitely. If you're picking a Kubernetes-native gateway today, Traefik or Kong's ingress controller cover the same ground and are actively maintained.
If you already run it, the strengths are real but backward-looking — the kubectl plugin is genuinely useful for live debugging, and the Helm chart is among the most thoroughly tested in the ecosystem. But its multi-tenant security model was broken by design even before retirement: the project's own docs warn that anyone who can create an Ingress object effectively gets cluster-admin influence over routing.
The recommended migration path to Gateway API has no automated tooling, so you're rewriting manifests by hand. This entry is on the list to be named, not recommended.
View on GitHub → Our full take →
// 8 of 8
★ 2,635 · Go · Apache-2.0 · updated Jun 2026
teams wanting a stateless, config-driven gateway with no plugin runtime
KrakenD is the answer if the etcd dependency that APISIX carries, or coordination overhead in general, is specifically what you're trying to avoid — it's stateless by design, deploy identical nodes behind a load balancer and you're done. The declarative JSON config is properly GitOps-friendly, and the memory footprint (roughly 50MB at 1,000 concurrent) beats Kong or APISIX by a wide margin.
The tradeoffs show up in daily use rather than architecture. Config changes need a restart — no hot-reload, so if you're iterating on routes often, APISIX's etcd-backed model will feel a lot better than KrakenD's. The JSON config also gets unwieldy past a few dozen endpoints with no native templating, so teams end up reaching for Helm or Jsonnet just to manage KrakenD itself.
And like Kong and Tyk, the CE/Enterprise line is opaque — you'll find out what's paywalled, RBAC and async agents among them, only once you need it, and the CE repo is thin enough that debugging below the surface means tracing into private modules you can't inspect.
View on GitHub → Our full take →
Questions people ask
What's the difference between an API gateway and a reverse proxy like Caddy or Traefik?
A reverse proxy routes traffic and terminates TLS; a full API gateway adds auth, rate limiting, and request/response transformation through a plugin system, usually with per-route policy control. Caddy and Traefik lean proxy-first with gateway features layered on through middleware, while Kong, APISIX, and Tyk are gateway-first with routing as just one plugin among many.
Is Kong still worth using over newer options like APISIX?
Yes if you want the widest plugin ecosystem and don't mind Lua — Kong's community and third-party plugin coverage is still ahead of APISIX's. If hot-reloading config without restarting workers matters more to you than ecosystem size, APISIX's etcd-backed model does that natively where Kong's DB-less mode doesn't.
Should I still use ingress-nginx?
No, not for anything new. It's officially retired with no security patches after March 2026, and the project's own README tells you not to start; use Traefik or Kong's ingress controller for Kubernetes-native routing instead.
Which of these avoids adding etcd, Consul, or Redis as a dependency?
Caddy, Traefik, and KrakenD all run without an external coordination store — KrakenD is stateless by design, and Caddy and Traefik keep state in-process. APISIX needs etcd for its standard deployment, and Tyk's rate limiting is Redis-backed, so factor that into your ops footprint before picking either.
The interesting differences between these show up after week three in production, not on a features page — figuring that out ahead of time is exactly the kind of thing the weekly email is for.
Get finds like these weekly →