API Security
API gateways that hold the front door (2026)
A 2026 shortlist of gates in front of APIs you operate. Public docs, not a bypass cookbook.
Expertise: API Security · Level: Intermediate · 12 min read
A WAF on the website is not a gateway on the API.
The API security list is auth, schema, and abuse. This page is the process that terminates TLS and applies the plugin. Overlap declared. Pick the gate, then lock the route.
Six gates. Three open-core proxies. One cluster proxy. One cloud button. One Envoy ingress. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Kong Gateway | Plugin gateway you can host | Apache-2.0 (OSS) / commercial |
| Apache APISIX | Apache gateway with etcd and plugins | Apache-2.0 |
| Tyk | Open-core API management plane | MPL-2.0 (gateway) / commercial |
| Traefik | The proxy your cluster already has | MIT (proxy) / commercial |
| Amazon API Gateway | The button if the API already lives on AWS | AWS terms |
| Emissary-ingress | Envoy ingress with a gateway story | Apache-2.0 |
Kong Gateway
Best for plugin gateway you can host
Kong is the known plugin gateway. OSS core. Enterprise plugins and Manager if you pay.
Key features
- Plugin model
- Self-host or Konnect
- Lua / PDK
- Huge operator memory
Why we like it
When the job is a plugin on the route, this is the name people already know.
Limits
Enterprise gravity. You still write the service. Not a schema linter.
Apache APISIX
Best for apache gateway with etcd and plugins
APISIX is an Apache gateway. etcd for config. Plugins for auth and limit. You operate it.
Key features
- Apache-2.0
- Plugin system
- etcd config
- Dashboard they ship
Why we like it
This is the hidden gem if Kong’s commercial plane feels like the product.
Limits
You staff etcd. Plugin quality varies. Stay on APIs you operate.
Tyk
Best for open-core API management plane
Tyk is gateway plus dashboard. Open core. Cloud if you will not host the plane.
Key features
- Gateway + dashboard
- Self-host or Tyk Cloud
- Policies they document
- MPL-2.0 on the gateway
Why we like it
When you want a management UI without AWS lock, Tyk is the honest pair.
Limits
Commercial features sit behind a license. We did not run Cloud.
Traefik
Best for the proxy your cluster already has
Traefik is an ingress proxy with an API gateway product next to it. A lot of Kubernetes estates already terminate here.
Key features
- Ingress you may already run
- Middleware
- File and CRD config
- Enterprise add-ons
Why we like it
Honesty. Sometimes the gateway is the ingress you refused to name.
Limits
Not a full API developer portal unless you buy one. Overlap with platform ingress.
Amazon API Gateway
Best for the button if the API already lives on AWS
Managed REST, HTTP, and WebSocket APIs. IAM, API keys, usage plans they document. Price is per call.
Key features
- Managed plane
- IAM and keys
- Same account as Lambda
- AWS docs
Why we like it
If compute is already Lambda, a second Kong is often vanity.
Limits
AWS-shaped. Cost at chatty clients. Vendor lock on the front door.
Emissary-ingress
Best for envoy ingress with a gateway story
Emissary is an Envoy-based Kubernetes ingress that Ambassador still documents as an API gateway. CRDs for mappings.
Key features
- Envoy data plane
- Kubernetes CRDs
- Apache-2.0
- You operate the cluster
Why we like it
When the cluster already speaks Envoy, this is the gate that does not invent a new proxy.
Limits
Kubernetes-shaped. You staff Envoy. Not a multi-cloud SaaS portal.
What the internet thinks about API gateways
Gateway threads treat plugins as the product. We agree, and we still send you to the API security list for schema and authz.
pachico on Hacker News, Oct 2024: “I wish there was an alternative to Kong API gateway where I didn’t need to write my plugins in Lua (the go and js sdks seem abandoned and are incomplete).”
Prove APISIX still publishes
Confirm APISIX still publishes. Point a new gate only at services you operate.
curl -fsSIL https://apisix.apache.org/ | head -n 8FAQs
Does a gateway replace API security tools?
No. The gate terminates. Schema, authz, and abuse live on the API security list.
Kong or APISIX?
Plugin memory versus Apache license and etcd. Read both. Order is editorial.
Is Traefik a gateway?
It is a proxy many people already run as one. Say that honestly.
Is this a scored bake-off?
No.
