Fit-based buyer guide

Managed versus self-hosted AI gateways: decide where operations should live

A managed AI gateway gives the service operator responsibility for gateway deployment, scaling and much of the incident path. A self-hosted gateway puts infrastructure, credentials, storage, upgrades and availability in your team's hands. Managed access is usually the shorter path to production. Self-hosting is justified when infrastructure location, custom policy or provider-account control is worth the ongoing operations. [1] [2] [3] [4] [5] [6]

Last reviewed 2026-08-15 · Editorial review: KeepRouter Editorial

Responsibility split between managed and self-hosted AI gateway operations — Deployment, credentials, storage, upgrades, and incident response move to different owners in each model.

Ownership table

Responsibility	Managed gateway	Self-hosted gateway
Gateway deployment	Vendor operates it	Your platform team deploys and scales it
Provider accounts	Vendor-funded, customer BYOK, or hybrid	Usually customer-owned provider keys
Data plane location	Vendor architecture and available regions	Your cloud, network or cluster design
Logs and storage	Vendor product and retention controls	Your databases, backups and deletion jobs
Availability	Vendor service plus upstream providers	Your gateway, dependencies and upstream providers
Upgrades	Vendor release process	Your testing, rollout, rollback and dependency response
Support	Contracted service path	Internal on-call plus open-source or commercial support
Cost	Usage, credits, subscription or platform fee	Infrastructure, storage, staff time and provider invoices

This is an ownership decision before it is a software decision. A self-hosted package can be easy to start and difficult to operate under load. A managed product can reduce operations while adding a new vendor and data path.

When managed is the clearer choice

Choose managed when a small team needs one working endpoint, no gateway infrastructure, and a defined support path. Managed model access is especially useful when the operator also handles provider relationships and billing. A BYOK managed control plane is useful when provider accounts must remain yours but deployment and policy operations should not.

KeepRouter belongs to the managed access category. Vercel AI Gateway and OpenRouter are managed routing products with different provider controls. Helicone offers a hosted gateway beside its observability platform. Read the AI gateway shortlist for product-level entry points.

When self-hosting earns its cost

Self-host when the gateway must run inside a specific network, integrate with internal identity and policy, or expose routing behavior that a managed product cannot provide. Teams already operating Kubernetes, service meshes, API gateways and production databases may absorb the extra service more easily.

LiteLLM offers a commonly used self-hosted proxy path. Portkey publishes self-hosted options. Kong AI Gateway extends an existing Kong platform. Each has a different license, control-plane and feature boundary, so "open source" alone is not enough. Review the LiteLLM comparison, Portkey comparison and Kong comparison separately.

Build an ownership register before selecting software

Create one row for every responsibility that must survive production: request entry point, gateway runtime, provider credentials, provider contract, model allowlist, routing changes, prompt and output handling, request logs, customer access, usage reconciliation, incident response and rollback. For each row, name the accountable team, the operating procedure, the evidence that proves the procedure works, and the person who approves an exception.

Fill the register twice, once for the managed candidate and once for the self-hosted candidate. A managed answer such as "the vendor handles it" is incomplete until the contract or product documentation identifies the service boundary and your team records its escalation path. A self-hosted answer such as "platform owns it" is incomplete until a runbook, alert and recovery test exist.

The finished artifact should fit on one reviewable sheet. Reject a candidate if a production responsibility has no owner, if a required log cannot be retrieved, or if the team cannot show who restores service after a failed upgrade. This register turns a product preference into an operating decision that security, finance and on-call staff can challenge before traffic moves.

The cost that spreadsheets miss

For self-hosting, include compute, database, cache, logs, backup, egress, secret management, high availability, alerts, dependency updates, incident response and engineering ownership. For managed products, include gateway fees, credit fees, plan limits, data retention, provider markup where applicable and the cost of vendor dependency.

Model inference usually dominates variable spend, but it is not the whole operating cost. Failed attempts and fallbacks can create charges on more than one route. The LLM pricing answer and cost-control guide provide a request-level model.

Set the cost and migration evidence boundary

Compare a fixed evaluation period and the same logical workload. For a managed gateway, record model charges, gateway or platform charges, integration work, retained observability systems and the staff time still required for access reviews and incidents. For self-hosting, record provider invoices, compute, storage, egress, backups, secret management, deployment work, monitoring, upgrades and on-call time. Keep one-time migration effort separate from recurring operation so a busy cutover month does not distort the steady-state estimate.

Count attempts rather than successful responses alone. One logical request may create a primary attempt, a retry and a fallback, while logs or caches add storage and retrieval costs. Attach each cost line to evidence such as an invoice item, usage export, infrastructure meter, work estimate or incident record. Vendor calculators can seed the sheet, but they cannot prove your traffic mix or staff burden.

Set migration gates before the comparison starts: required routes pass contract tests, security accepts the data path, billing records reconcile within the agreed tolerance, the on-call team completes a failure drill, and rollback meets the service objective. Evidence from one layer stops at that layer. A gateway usage record does not prove the provider invoice, and a cloud bill does not prove that an application received a valid response.

Run a failure drill before deciding

Expire a provider credential and observe the user-facing error.
Make the primary upstream time out and inspect retry plus fallback evidence.
Interrupt streaming after partial output.
Restore the gateway from backup or replace an unhealthy instance.
Revoke a customer key and confirm logs no longer expose access.
Roll back a gateway version or policy change.
Reconcile every attempt with usage and billing records.

The managed candidate should expose enough evidence to explain the incident. The self-hosted candidate should prove that your team can operate the recovery path. Use the security checklist and failover guide during the drill.

A hybrid is still two responsibilities

Some products offer a managed control plane with a customer-hosted data plane, or a hosted gateway with BYOK. That can satisfy network and provider ownership requirements, but it does not erase the split. Record who upgrades each component, where logs live and which party handles an outage.

Frequently asked questions

Is self-hosting always cheaper?

No. Add infrastructure, storage, security, upgrades, high availability and staff time to provider charges before comparing total cost.

Does managed mean no operations?

No. Your team still owns application behavior, key scope, evaluation, data classification, incident decisions and vendor review.

Can a managed gateway use my provider keys?

Some can through BYOK. Verify credential storage, fees, provider fallback and invoice reconciliation in the current plan.

Who handles an upstream model outage?

Both models still depend on upstreams. The difference is who operates gateway detection, retries, fallbacks and customer communication.

What is a hybrid gateway deployment?

It usually splits a managed control plane from a customer-hosted data plane, or combines hosted routing with customer provider credentials.

Sources reviewed

Sources last reviewed 2026-08-15