Fit-based buyer guide

The best AI gateway depends on who should own access, routing and operations

Shortlist AI gateways by the work you need done: managed model access, controls for existing provider accounts, request observability or an API platform you already operate. Compare eight options using a concrete workload and cost per accepted task. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

Last reviewed 2026-09-29 · Editorial review: KeepRouter Editorial

Decision map comparing managed, BYOK, self-hosted, cloud, and API-platform gateway ownership — Start with operating ownership, then compare products inside the matching gateway model.

AI gateway shortlist by operating fit

This is an unordered shortlist, not a performance ranking. Each option represents a different ownership model or product emphasis. Confirm current routes, prices and policies in the linked comparison and official sources.

KeepRouter
Managed prepaid model access with a public catalog and compatible API routes for supported models.
Vercel AI Gateway
Managed routing with close AI SDK and Vercel integration, provider options and BYOK.
OpenRouter
Managed multi-provider model access with detailed request-level provider routing controls.
Portkey
Gateway and control-plane tooling with managed and self-hosted options, observability and governance features.
LiteLLM
Open source proxy and SDK for teams that want to operate their own multi-provider control plane.
Helicone
Observability-first platform with a hosted gateway, request logging, cost tracking and evaluation workflows.
Cloudflare AI Gateway
Cloudflare traffic control, logging, security and routing for AI calls with BYOK and unified billing paths.
Kong AI Gateway
AI, MCP and agent traffic governance built on Kong's API platform and deployment models.

Which AI gateway should you shortlist?

For a small application that needs model access, compare managed catalogs containing the exact model you want. For a team with existing provider accounts, compare gateways that can apply policy to those accounts. For an organization already operating an API platform, first check whether that platform meets the AI requirement. This guide is published by KeepRouter; the recommendations describe product fit. We have not run a shared speed or reliability benchmark across these products.

Eight options and the decision each one helps with

Product	A useful reason to consider it	Check before adopting it
KeepRouter	Prepaid access to a supported model with a KeepRouter key	Exact endpoint, current customer rate and required model behavior; no self-serve BYOK or customer provider ordering
Vercel AI Gateway	AI SDK integration with managed access and provider options	Credentials, routing settings and how BYOK spending differs from gateway-credit spending
OpenRouter	Managed model access with explicit request-level provider preferences	Allowed providers, fallback policy and required parameters for your model
Portkey	A shared model catalog with credential and access controls	Team permissions, budgets and the edition or deployment that supplies each control
LiteLLM	Operating an OpenAI-style proxy against your provider accounts	Deployment, upgrades, storage, secrets and who handles incidents
Helicone	Adding request observability to an LLM application	Integration path, recorded content and retention settings
Cloudflare AI Gateway	Caching, rate limits and routing controls alongside Cloudflare services	Current endpoint, applicable features and whether calls use your keys or Unified Billing
Kong AI Gateway	Extending a Kong API platform to AI traffic	Required plugins, deployment model and operational ownership

The linked official documentation supports the product descriptions. A feature's presence in documentation does not establish that it is enabled on your account or compatible with every model. KeepRouter's API reference and security page describe its own public behavior.

Three practical starting points

Two developers building a chat feature. Pick two managed services that publish the required model and API shape. Try the same conversation, one stream and one deliberately invalid request. Record the answer, error, usage and charge. If both pass, account setup and support may matter more than a long list of routing switches. KeepRouter belongs on this shortlist when its catalog fits.

Several teams already paying model providers. Start with credential ownership, team permissions and spend reporting. Compare products such as Portkey, or a LiteLLM proxy your team can operate. Vercel and OpenRouter also document BYOK or provider controls, so inspect the exact capability before treating these as exclusive categories. KeepRouter's managed catalog does not replace a requirement to bring your provider accounts.

An application using gateway-specific behavior. List that behavior before moving anything. A Cloudflare response cache, a Kong plugin or a provider-specific routing rule will not follow a base URL change automatically. Staying with the current product may be the better decision if those features are essential. The migration checker checks credential-free request configuration; it cannot inspect account-level gateway rules.

Compare the cost of one accepted task

Count every model attempt, separately billed platform features, infrastructure and recurring maintenance. Show cash spending separately from allocated engineering time. A cheaper input-token rate can still cost more per accepted task if it requires longer prompts, extra calls or more manual review.

For a deliberately hypothetical example, 1,000 tasks at $0.01 per attempt and one attempt per task cost $10. At $0.008 and an average of 1.5 attempts, they cost $12. This is arithmetic, not a provider price or benchmark; both paths must also satisfy the same answer-quality requirement. Use the cost worksheet to include rejected tasks and the API cost calculator for currently published KeepRouter units.

Billing methods also change what a dashboard measures. Vercel's BYOK documentation distinguishes your provider-key spending from gateway-credit spending. Cloudflare Unified Billing has its own credit-purchase rules. Reconcile the chosen access method before comparing dashboard totals.

Finish with a small, reproducible trial

Choose a fixed set of real task shapes using non-sensitive example data. Include a tool conversation if the product needs tools; a text-only success cannot approve it. Set an output limit and a total experiment budget, keep retries visible, and preserve a working rollback configuration. The gateway evaluation guide includes a sample result sheet and acceptance criteria.

Your decision record needs the tested model and endpoint, relevant settings, accepted-task count, total charge, failure notes and date. Keep the current service if the alternative fails a required behavior. Expand only after the new path meets the requirement at a cost and maintenance burden the team can sustain.

Frequently asked questions

Which AI gateway is best?

The useful answer depends on operating ownership. Select managed access, BYOK, self-hosting or a cloud platform first, then compare products inside that model.

Is this list ranked by speed?

No. There is no shared benchmark here. Measure the exact region, model, route, payload and percentile your application needs.

Do all gateways include model billing?

No. Managed catalogs can bill model use, while BYOK and self-hosted products commonly use provider accounts you own.

Can one test prompt prove compatibility?

No. Test non-streaming, streaming, tools, errors, usage and the exact production payload before approval.

How often should this shortlist be reviewed?

Review it when a required route, model, price, provider policy, deployment need or team constraint changes.

Sources reviewed

Sources last reviewed 2026-09-29