Kong vs Envoy vs Tyk vs AWS API Gateway 2026

The old gateway question was “which reverse proxy has the best plugin ecosystem?” The current decision starts with ownership: who runs the data plane, where configuration lives, which API types matter, and whether the team needs a managed service, a Kubernetes application gateway, or a broader API-management control plane.

TL;DR verdict

Kong fits teams evaluating a hybrid or multi-cloud gateway with plugin extensibility and a choice between Konnect and self-managed deployment.
Envoy fits teams that want a programmable proxy data plane; Envoy Gateway adds a standalone or Kubernetes application-gateway layer using Kubernetes Gateway API resources.
Tyk fits teams comparing Cloud, Hybrid, and Self-managed API-management deployment under one vendor. Verify the feature and portal scope of the exact plan.
AWS API Gateway fits AWS-native teams that want the service to own gateway infrastructure and accept API-type-specific capabilities, quotas, and request pricing.

No throughput winner is named here. The approved evidence does not provide a common, current, reproducible benchmark across all four products.

API fit matrix

Architecture job	Kong	Envoy	Tyk	AWS API Gateway
Hybrid or multi-cloud API gateway	Direct fit to evaluate	Requires a control/configuration approach	Direct fit to evaluate	AWS service only
Kubernetes application gateway	Evaluate Kong's Kubernetes path	Envoy Gateway is designed for this role	Verify the current Kubernetes deployment path	Not a Kubernetes-hosted gateway
Fully managed gateway infrastructure	Konnect packaging	Bring or choose a control plane	Cloud plan	Core service model
Self-managed data plane	Available	Core deployment model	Self-managed plan	Not self-hosted
Serverless AWS integration	Possible through normal upstreams	Possible through normal upstreams	Possible through normal upstreams	Direct product fit
Procurement model	Konnect and self-managed are separate packaging	Open-source project plus chosen operations stack	Cloud, Hybrid, and Self-managed	Usage and add-on pricing by API type

1. Kong

Kong Gateway is positioned as a hybrid and multi-cloud API gateway with plugin extensibility. Konnect and self-managed deployment are separate packaging choices, so the operating model and price comparison should not collapse them into one row.

The current pricing page describes a 30-day trial, Plus resource packaging, Enterprise packaging, and custom pricing for fully self-hosted enterprise use. Verify the live resource definitions and any plugin or governance requirements before purchase.

The existing installation targets remain useful starting points for a proof of concept:

curl -Ls https://get.konghq.com/install.sh | bash
helm repo add kong https://charts.konghq.com

In the proof of concept, configure one route, one authentication method, one rate policy, observability export, and a failure-mode test. Count the operational dependencies introduced by the selected plugins.

2. Envoy

Envoy Proxy is the programmable data plane. Envoy Gateway manages it as a standalone or Kubernetes application gateway using Kubernetes Gateway API resources. That makes Envoy Gateway a clearer comparison subject for application ingress than a raw Envoy configuration alone.

The official repository uses Apache-2.0. The “latest” documentation can reflect main-branch work, so pin evaluation to a release and read the matching documentation rather than carrying a version number forward from an older guide.

AWS App Mesh support ends September 30, 2026. Treat that as a migration fact, not a forward-looking reason to choose Envoy.

3. Tyk

Tyk currently presents Cloud, Hybrid, and Self-managed deployment. Its pricing page also separates Core, Professional, and Enterprise packaging and shows the developer portal in current paid-plan descriptions. The public page does not provide the older fixed monthly amounts, so use a current quote for budget work.

The free open-source gateway and paid API-management plans are distinct evaluation scopes. Verify portal, analytics, governance, and support features against the exact package rather than assuming feature parity.

The original self-hosted bootstrap link remains available for a technical trial:

curl https://raw.githubusercontent.com/TykTechnologies/tyk-gateway-docker/master/docker-compose.yml -o docker-compose.yml
docker compose up

4. AWS API Gateway

AWS API Gateway is the managed option in the comparison. Its strongest fit is an AWS-native stack that values service ownership of the gateway and direct integration with surrounding AWS services. The tradeoff is an AWS-specific API, quota, and cost model.

AWS pricing must be read by API type and tier. The official pricing example uses $3.50 per million REST API calls, and separate data-transfer charges and optional add-ons can apply. At the request tiers displayed on 2026-08-21, 1B HTTP API requests total $930 and 1B REST API requests total $3,033.10 before transfer or add-ons. These are page-tied arithmetic examples, not universal regional quotes.

Auth matrix

Evaluation question	Kong	Envoy	Tyk	AWS API Gateway
Where is auth enforced?	Gateway plugin/configuration	Proxy filter or surrounding control plane	Gateway/plan configuration	API-type-specific AWS configuration
Who owns identity integration?	Platform team plus selected plugin	Team operating the filter/control plane	Platform team plus selected Tyk package	AWS account and API owners
What must be verified?	Plugin availability by package and deployment	Filter support, config distribution, and failure policy	OSS versus paid auth and portal scope	REST, HTTP, and WebSocket differences
Main operational risk	Plugin and secret sprawl	Building too much control-plane behavior	Assuming plan parity	Coupling authorization to AWS service design

This matrix defines due diligence, not feature parity. Authentication, GraphQL, portal, analytics, and protocol support need exact primary documentation at the package and API-type level before a final capability cell is marked.

SDK and configuration quality table

Surface	Acceptance test
Declarative configuration	Apply the same reviewed config to a clean environment and compare results
Admin or management API	Create, update, roll back, and audit one route without manual console repair
Kubernetes resources	Reconcile a route and policy through the chosen controller or Gateway API path
Infrastructure as code	Detect drift and replace a test environment from source control
Error reporting	Trace rejected config and failed upstream requests to an actionable cause
Version compatibility	Pin control plane, data plane, extensions, and schema versions used in the test

An API client or configuration SDK is only as useful as its compatibility contract. Test upgrade and rollback paths beyond resource creation.

Minimal configuration examples

The following upstream URL is intentionally preserved from the original examples:

services:
  - name: user-service
    url: http://users.internal:8080
    routes:
      - name: users-route
        paths: [/api/users]

For Envoy Gateway, prefer release-matched Kubernetes Gateway API resources for a Kubernetes evaluation. For raw Envoy, keep xDS ownership explicit. For Tyk and Kong, separate data-plane configuration from paid control-plane features. For AWS, model the selected API type in infrastructure as code and test the resulting quotas and logs.

Rate-limit box

AWS API Gateway defaults to 10,000 RPS with a 5,000-request burst capacity in most Regions. The current lower-quota Region list uses 2,500 RPS and 1,250 burst: Africa (Cape Town), Europe (Milan), Asia Pacific (Jakarta), Middle East (UAE), Asia Pacific (Hyderabad), Asia Pacific (Melbourne), Europe (Spain), Europe (Zurich), Israel (Tel Aviv), Canada West (Calgary), Asia Pacific (Malaysia), Asia Pacific (Thailand), and Mexico (Central). AWS says the RPS quota can be increased, while burst capacity is service-controlled.

For Kong, Envoy, and Tyk, do not infer distributed accuracy from the presence of a “rate limit” feature. Test counter storage, failure behavior, clock/window semantics, key cardinality, and policy propagation in the exact deployment. Compare local protection, global customer quotas, and billing enforcement as separate jobs.

Capability comparison without false parity

The old feature grid blurred OSS versus paid features and API-type-specific AWS behavior. A defensible replacement records evidence at a narrower level:

Capability area	Decision record required
Authentication	Exact plugin, filter, plan, or AWS API type and primary documentation
Developer portal	Package name, deployment model, and current entitlement
GraphQL and gRPC	Protocol mode, limits, and paid/extension dependency
Analytics	Included service, external sink, retention, and pricing
Service mesh	Product role and supported control plane
WebSocket	API type, message/connection pricing, and quotas

Hold any cell that lacks an exact current citation. A blank cell is safer than a confident but package-blind checkmark.

Integration risk box

Kong: count plugin dependencies, secret backends, database requirements, and Konnect/self-managed ownership.
Envoy: identify who owns xDS or Gateway API reconciliation, extension compatibility, and safe config rollout.
Tyk: confirm the boundary between the open-source gateway and paid portal, analytics, governance, and support.
AWS API Gateway: model API type, Region, request tiers, transfer, add-ons, account quotas, and IAM ownership.

For every option, test config rollback, upstream timeout, auth-provider failure, rate-store failure, log export, certificate rotation, and a control-plane outage. The best fit is the one whose failure ownership matches the team that will be on call.

Source-backed evidence

Deployment evidence

Kong supports hybrid/multi-cloud positioning with Konnect and self-managed choices. Envoy Gateway supports standalone and Kubernetes application-gateway use. Tyk lists three deployment models. AWS owns the gateway service inside AWS.

Cost and quota evidence

Only the AWS request examples are calculated here, and they are tied to the pricing page accessed 2026-08-21. Tyk and Kong require current package/quote review. AWS quotas are copied from the current official quota page.

Benchmark evidence

No approved source set establishes comparable throughput or latency across the four products. Run one workload, topology, policy set, hardware profile, and measurement method before making a performance claim.

Methodology

APIScout reviewed eight current primary sources on 2026-08-21: vendor/project documentation, official repositories, pricing pages, AWS quotas, and the AWS App Mesh end-of-support notice. We preserved product order and comparison intent while removing stale version pins, repository popularity counts, unsupported package claims, old price ranges, false arithmetic, and cross-product performance rankings.

Source-backed FAQ

Is Envoy Gateway only for Kubernetes?

No. Its official repository describes both standalone and Kubernetes application-gateway roles, with Kubernetes Gateway API resources provisioning and configuring Envoy Proxy in the Kubernetes path.

Does Tyk publish a current fixed Cloud price?

The selected current pricing page presents packaging and deployment choices without the old fixed monthly figures. Request a current quote for the intended plan and usage.

Is the AWS free tier permanent?

Do not model it as an unconditional recurring allowance. The current pricing page describes time- and customer-specific programs; use the live terms for the target account.

Can this evidence rank gateway performance?

This evidence set cannot answer that. Use a common reproducible benchmark with the policies and topology you will operate.

Sources

Kong Gateway documentation — accessed 2026-08-21
Kong pricing — accessed 2026-08-21
Envoy Gateway API gateway concepts — accessed 2026-08-21
Envoy Gateway official repository — accessed 2026-08-21
Tyk pricing and deployment options — accessed 2026-08-21
Amazon API Gateway pricing — accessed 2026-08-21
Amazon API Gateway quotas — accessed 2026-08-21
AWS App Mesh end-of-support notice — accessed 2026-08-21

Track Kong, Tyk, and AWS API Gateway uptime and API health on APIScout.

{/* Sources: gw-kong-docs, gw-kong-pricing, gw-envoy-gateway, gw-envoy-repository, gw-tyk-pricing, gw-aws-pricing, gw-aws-quotas, gw-appmesh-eos. Claims: gw-a01, gw-a02, gw-a03, gw-a04, gw-a05, gw-a06, gw-a07. */}

The API Integration Checklist (Free PDF)