Portkey Alternatives (2026): 6 Gateways Compared After the Palo Alto Acquisition

TL;DR

Portkey was acquired by Palo Alto Networks in May 2026. That is a real event with real consequences for existing customers. Pricing roadmap ownership shifts, feature priorities re-align with PANW's Prisma stack, and the product's independent trajectory becomes a question mark. Combine that with Portkey's log-metered pricing model ($49/mo Production + $9 per 100K logs, Enterprise starting around $5-10K/mo) and a lot of teams are re-evaluating. This post compares six real alternatives (Leanroute, LiteLLM, Bifrost, Kong AI Gateway, Helicone, and OpenRouter) on the dimensions that actually matter after the acquisition. It is written by the Leanroute team, but includes the cases where you should stay on Portkey.

Why the PANW Acquisition Changed the Conversation

Acquisitions are not automatically bad. But they change three things for customers, always:

Roadmap ownership. Portkey's product priorities used to answer to Portkey's users. They now answer to Palo Alto Networks' strategic goals, which are large (Prisma Cloud, Prisma Access, XSIAM) and might not treat LLM gateway prioritization the same way an independent Portkey did. Features that made sense as a standalone gateway (deep prompt management, indie-dev-friendly pricing) may deprioritize in favour of features that make sense as part of a broader security stack.

Pricing power. Enterprise-security acquirers historically re-price acquired products upward, or bundle them into higher tiers. This has not visibly happened at Portkey yet, but the incentive is there. A customer on the $49/mo Production plan should assume the plan is not permanent at that price.

Focus on the enterprise buyer. PANW sells to CISOs. Portkey, pre-acquisition, sold to platform engineers and AI teams. The two buyers care about different things. Post-acquisition roadmap will drift toward what CISOs care about (compliance, audit, DLP for prompts) and away from what AI teams care about (fast provider adds, prompt experimentation, cost visibility).

None of this means "leave Portkey today." It means "check that your gateway vendor's incentives still align with yours," which is the correct hygiene after any acquisition of an infrastructure tool you depend on.

The Second Trigger: Log-Metered Pricing at Scale

Portkey's pricing model was the other reason people started searching for alternatives even before the acquisition. Production is $49/mo + $9 per 100K logs. That works fine for a small app. At production traffic it stops working:

Requests/month	Log cost	Total (Production plan)
100K	$9	$58
1M	$90	$139
10M	$900	$949
50M	$4,500	$4,549
100M	$9,000	$9,049

A team doing 10M requests/month is paying ~$950/mo on Portkey purely for logs. Enterprise contracts (starting around $5-10K/mo) exist to solve this, but the pricing conversation gets uncomfortable somewhere between 10M and 50M requests when the Production tier stops making sense and Enterprise has not yet been negotiated.

The cost is fine when it is invisible. When your finance team spots a $950/mo line item and asks "what is this," the conversation about switching starts.

Quick Decision Tree

Before the detailed comparison:

You want to stay on Portkey OSS (self-hosted, avoid the managed pricing question) → legitimate move, PANW does not control the OSS repo unilaterally.
You want managed BYOK with flat pricing regardless of traffic → Leanroute.
You want managed with a similar enterprise-shaped feature set and are willing to pay for it → stay on Portkey, or move to TrueFoundry ($499/mo Pro).
You want self-hosted with the fastest data path → Bifrost.
You want self-hosted with the widest provider coverage → LiteLLM.
You want observability only, without routing → Helicone.
You just want one API key for many models and you are pre-production → OpenRouter.

Now the details.

The Six Alternatives

1. Leanroute (us)

Flat $15 (Starter) or $25 (Pro) per month, BYOK to 14 curated providers, MCP passthrough on the same endpoint, 7-rule guardrail library at the gateway edge, hard spend caps enforced before your provider invoice grows. Managed, no ops burden. OpenAI-compatible wire.

Best for: startup and mid-market teams that were on Portkey Production and watching the log-metered bill grow with traffic. Flat pricing means gateway cost is bounded regardless of RPS. BYOK means you keep provider rate limits, commitments, and negotiated discounts.

Not for: teams that need Portkey's prompt-management UI as a core workflow (we don't ship that yet), teams whose compliance requires a Gartner-MQ vendor (we are not on it, honest about that), or teams that need 40+ providers (we cover 14 curated, see LiteLLM for breadth).

2. LiteLLM (self-hosted)

Free, MIT-licensed, 100+ providers, mature ecosystem. Python proxy. The reference OSS option since 2024. Post-CVE-2026-35029 the community has been patching diligently, but the ops burden is real. Our working estimate is 15-25 engineer-hours per week for a production-grade deployment.

Best for: teams with an existing platform group who want maximum provider breadth and are comfortable running Python + Postgres + Redis in prod.

Not for: teams without SRE headcount. Free-to-download is not free-to-run.

3. Bifrost (Maxim AI)

Go-based, Apache 2.0, 12+ providers, MCP + semantic caching built in. Published benchmarks show 40-50x LiteLLM throughput at the data path. Self-hosted, zero-config startup.

Best for: teams that want a fast self-hosted alternative to LiteLLM and have the platform team to run it. See our Bifrost alternative post for the full comparison.

Not for: teams that want managed. Bifrost is self-host only.

4. Kong AI Gateway

Enterprise API gateway with an AI layer bolted on. Self-hosted. Enterprise contracts start around $30-50K annually and scale into six figures. Best fit if you already run Kong for your non-AI services.

Best for: enterprises with an existing Kong footprint and an SRE team already trained on the operational model. Procurement-safe choice for regulated buyers.

Not for: startups. The setup surface and licensing cost do not make sense unless Kong is already in the stack. See our Kong AI Gateway alternative post for the full argument.

5. Helicone

Observability-first. Proxy-mode routing as a secondary function. Simple integration: change your base URL and get a dashboard. Free tier with paid observability upgrades.

Best for: teams that want to see what their app is spending on LLM calls without owning the routing layer. Helicone logs everything, you get charts, you keep talking to providers directly.

Not for: teams that need routing decisions, failover, multi-provider BYOK behind a single endpoint, or MCP passthrough.

6. OpenRouter

One API key, hundreds of models, they hold provider keys, they mark up per token. Great for prototyping. Becomes expensive around $200-500/mo of LLM spend when the markup crosses the flat-fee alternatives.

Best for: individual developers exploring models, hobbyists, small apps where the "one credit card, many models" simplicity is the whole win.

Not for: production workloads at scale, teams that already have provider commitments and want BYOK. See our OpenRouter alternative post for the break-even math.

Comparison Table

Dimension	Portkey (managed)	Leanroute	LiteLLM (self-host)	Bifrost (self-host)	Kong AI (self-host)	Helicone	OpenRouter
Pricing model	$49/mo + $9/100K logs	Flat $15 / $25 monthly	Free + ops	Free + ops	$30-50K+/yr	Free + paid obs	Per-token markup
Hosting	Managed (post-PANW)	Managed	Yours	Yours	Yours	Managed or self	Managed
BYOK	Yes	Yes, 14 providers	Yes	Yes	Yes	Yes (proxy)	No (they hold)
Providers	40+	14 curated	100+	12+	Depends on plugins	Proxy-passthrough	100+
MCP passthrough	Roadmap	Native	Via plugins	Native	Via plugins	No	No
Guardrails at edge	Yes (paid tier)	7 built-in	Via plugins	Via config	Via plugins	No	No
Prompt management UI	Yes	Roadmap	No	Basic	No	No	No
Hard spend caps	Yes	Enforced at edge	Yes (config)	Yes (config)	Yes (plugin)	Alerts only	Alerts only
Ops burden	None	None	High	Medium	Medium-high	Low	None
Vendor independence	PANW (May 2026)	Independent	Independent (OSS)	Maxim AI	Kong	Independent	Independent
OpenAI-compatible wire	Yes	Yes	Yes	Yes	Yes	Yes	Yes

When Portkey Is Still the Right Call

We would rather you pick correctly than pick us. Cases where you should stay on Portkey:

You're deep in Portkey's prompt management workflows. Their prompt registry, versioning, and A/B testing UIs are more mature than most alternatives. Migrating a large prompt library elsewhere is a real cost.
Your compliance team already vetted Portkey. Re-vetting a new vendor takes months. If the acquisition does not change your compliance answer, don't create work.
You're already on Enterprise and the pricing was negotiated. The public $5-10K/mo Enterprise entry point is what walks in; what walks out is usually different. If your rate is defensible, log-metering may not be your problem.
You value the enterprise-security roadmap direction. If your buyer is a CISO, the fact that Portkey is now under PANW's Prisma umbrella may actually help procurement rather than hurt it.
You want the Portkey OSS gateway self-hosted. PANW does not control the pace of OSS releases unilaterally. If your team is comfortable with self-hosting, the OSS path removes the pricing and roadmap concerns entirely.

When to Actually Move

Move if two or more of these are true:

Your monthly log-metered bill has crossed $500 and is climbing.
You are on Production plan and haven't started the Enterprise conversation but sense you'll need to.
Your buyer is not a CISO. You're an AI team or a startup building a product, and PANW's roadmap direction is not what you want to bet on.
You have not deeply invested in Portkey's prompt-management workflows.
You want your gateway vendor to be independently owned and incentivized to serve your buyer shape specifically.

If you match three or more, the switching effort will pay back within a quarter.

How the Migration Works

Both Portkey and Leanroute are OpenAI-compatible, so the wire format does not change:

Sign up for Leanroute. BYOK Starter is $15/mo, 14-day free trial.
Paste your provider keys into the Providers page. OpenAI, Anthropic, Google, xAI, DeepSeek, Bedrock. Keys are AES-256-GCM encrypted at rest, so a database dump reveals nothing usable.
Change your base URL from Portkey to https://api.leanroute.dev/v1. Same OpenAI SDKs work unchanged.
Run 10% of traffic through Leanroute for two weeks. Compare logs, latency, and cost on both sides.
Flip the ratio when the numbers agree. Cancel Portkey when the last request drains.

Prompt management is the gap. If you rely heavily on Portkey's prompt registry today, the migration is more work. You'll need to move prompts into your own code or into a lightweight registry like our upcoming prompt-store feature. For teams that keep prompts in git already, this is a non-issue.

The Broader Point

Every category has an acquisition wave. Web API gateways had one in 2015-2018 (Kong stayed independent, Apigee got acquired by Google, MuleSoft by Salesforce). Cloud databases had one in 2019-2022. LLM gateways are having one now. Portkey to PANW is likely the first of several.

The right hygiene after any infrastructure acquisition is not to panic-leave. It is to check whether the acquirer's incentives still align with your usage shape. For a lot of Portkey customers on Production plan hitting real production traffic, they don't. For enterprises already deep in the enterprise conversation with a CISO buyer, they probably still do.

If you want a flat-fee, independently-owned, managed BYOK alternative, we're at leanroute.dev. If you want to stay on Portkey and just move to OSS, the Portkey Gateway repo is right there. Both are legitimate answers to different questions.

Sources: