Portkey provides applications with a single OpenAI-compatible endpoint for a large model catalog, along with failover logic, scoped credentials, usage visibility, and policy checks, all available through the same gateway. It is especially useful for centralizing model access and reliability controls without maintaining separate connections for every provider.
Developers look for Portkey alternatives when log-metered pricing, short retention windows, hosted deployment limits, or additional latency across multi-call workflows create cost, compliance, or performance concerns. The Palo Alto Networks acquisition also places Portkey inside Prisma AIRS, and its future as a standalone, vendor-neutral gateway is now less clear.
This guide compares six Portkey alternatives across provider breadth, caching, cost attribution, guardrails, self-hosting, and governance, then explains which Portkey assets require migration. Braintrust Gateway is the strongest choice when gateway traffic must inform evaluation and release decisions. Start free with Braintrust.
What Portkey offers
An application sends each request through Portkey's OpenAI-compatible Universal API, which covers 1,600+ models across major providers, cloud platforms, and custom endpoints. Before the request reaches a model, routing configs apply fallbacks, load balancing, retries, conditional rules, and simple or semantic caching. At runtime, the request can also draw on provider credentials and access rules stored in the Model Catalog, as well as versioned templates from Prompt Management.
Across that request path, hosted observability records logs, traces, metadata, feedback, and alerts for debugging and cost analysis. Guardrails apply deterministic, model-based checks to inputs and outputs, and paid plans add RBAC, service account keys, budget limits, and compliance options. Portkey publishes the routing core as open source, although organization-level governance and enterprise deployment controls remain part of its managed plans.
Why teams look for Portkey alternatives
Log coverage and retention: Because pricing is tied to recorded logs, a traffic spike can either create overage charges or leave part of the month unrecorded, depending on the plan. Retention windows of three or 30 days may also be too short for longer investigations and compliance reviews.
Deployment and latency: The default hosted deployment places observability and governance outside the application's network boundary, which may conflict with data residency policies. Gateway overhead also compounds across agentic workflows because every step passes through the proxy.
Acquisition impact: Palo Alto Networks completed its acquisition of Portkey in May 2026 and now positions it as the Prisma AIRS AI Gateway, tying its future direction to a broader enterprise security suite. Organizations that selected an independent gateway to avoid LLM provider lock-in must now decide whether the new direction preserves the vendor neutrality they expected.
How to evaluate Portkey alternatives
Because Portkey combines routing, reliability controls, access management, and request visibility into a single endpoint, a replacement must preserve existing production behavior and address the limitation driving the migration.
OpenAI SDK compatibility: The lowest migration cost comes from an OpenAI-compatible endpoint that accepts existing client calls after only a base URL and API key change. Request rewrites, custom adapters, or unsupported SDK methods expand the work into application code and should be included in the migration scope.
Provider and model coverage: Provider coverage must include every model currently routed through Portkey and any providers planned for future use. Coverage also depends on whether streaming, tool calling, multimodal input, and provider-specific parameters pass through the gateway.
Caching controls: Compare the existing Portkey configuration with available caching types, TTL controls, data scopes, and cache-status visibility. The caching strategy should specify whether results are shared across requests, per user, or bypassed for sensitive data, since each choice affects latency, cost, and data exposure.
Cost attribution: Useful cost reporting preserves the dimensions already used for budgets, including models, projects, API keys, features, and end users. A lower gateway fee may still create a reporting gap if you can't trace spend to the application or workload that generated it.
Guardrails and evaluation: Inline guardrails block policy violations before returning output, and post-response evaluation measures quality after generation. The replacement may need one or both, depending on whether the goal is runtime enforcement, release validation, or complete coverage across both stages.
Self-hosting and data control: Self-hosting must cover every component subject to data residency requirements, since running the proxy within a private network does not automatically include logs, guardrails, and governance data. Map each component to the network boundary and retention policy it must follow.
Governance and RBAC: Governance controls must remain available at the scopes where you manage access and spending. Credentials, roles, budgets, rate limits, and audit logs may need separate enforcement across organizations, projects, applications, or API keys.
Use of production logs: Assess what logged requests feed beyond debugging and cost analysis. Connections to datasets, scorers, experiments, and CI checks turn production behavior into evidence for the next model or prompt release.
Also read: The best AI gateways compared
6 best Portkey alternatives in 2026
1. Braintrust Gateway
Best for: Organizations replacing Portkey that need multi-provider routing, caching, failover, cost visibility, tracing, and evaluation.
Braintrust Gateway routes requests to OpenAI, Anthropic, Google, AWS, Azure, Mistral, and other AI providers through a unified endpoint. Existing OpenAI, Anthropic, and Gemini SDK clients only require the Gateway URL and a Braintrust API key, and a provider SDK can call models hosted by another provider. Credentials are configured at the organization or project level, with custom providers bringing self-hosted, fine-tuned, and proprietary endpoints into the same request path.
The hosted Gateway uses global and region-specific endpoints, with DNS-latency routing and health checks. Provider failover retries eligible outages, rate limits, and server errors against an ordered list of configured providers, including streaming requests. Response headers identify the provider endpoint that completed the call, record the original and replacement providers when failover occurs, and expose the error origin, request ID, and logged span ID.
When Gateway logging is active via a project or trace header, each call appears as a span in Braintrust observability, including its input, output, latency, token usage, cost, cache status, and provider details. You can add scores, metadata, or feedback to the returned span ID after the request completes. From there, Braintrust evaluation turns trace data into datasets, scorer results, and experiments, with CI checks catching regressions before release.
Gateway response caching includes auto, always, and never modes, per-request TTLs, Cache-Control directives, and HIT or MISS headers. Cached data is encrypted with AES-GCM using a key derived from the Braintrust API key, which scopes entries to an individual user by default. Logged gateway requests then feed Braintrust dashboards, where usage, cost, latency, errors, and evaluation scores appear in the same view.
Pros:
- Unified endpoint across major model providers
- Cross-provider calls through OpenAI, Anthropic, and Gemini SDKs
- Organization and project-level credentials with custom provider support
- Global and regional endpoints with latency routing and health checks
- Ordered provider failover for retryable errors and streaming requests
- Gateway logging within distributed traces with returned span IDs
- Trace data connected to datasets, scorers, experiments, and CI checks
- Encrypted response caching with configurable modes, TTLs, and user scoping
- Response headers for cache, provider, failover, error, request, and span details
- Dashboards for usage, cost, latency, errors, and evaluation scores
Cons:
- Hosted Gateway is in beta
- Self-hosting requires Enterprise
Pricing: Free Starter plan with 1 GB processed data, 10K scores, and unlimited users. Pro at $249/month. Custom enterprise pricing. Braintrust Gateway is free during beta. See pricing details.
Also read: Best LLM gateways for developers
2. OpenRouter
Best for: Developers who need broad hosted model access through one OpenAI-compatible API.
OpenRouter exposes more than 500 active models from over 80 providers, with default routing based on provider health and price. Request controls can prioritize throughput, latency, cost, and data policies, and eligible provider failures trigger automatic fallback. Workspaces separate API keys, budgets, routing rules, guardrails, and activity by application or environment. OpenRouter remains fully hosted, and its code-based evaluation tooling does not include managed production-trace datasets or experiment comparisons.
Pros:
- More than 500 active models across 80+ providers
- OpenAI-compatible API
- Health-aware routing and automatic provider fallback
- Workspace budgets, guardrails, and routing policies
Cons:
- Hosted deployment only
- No managed trace-to-experiment workflow
Pricing: Pay-as-you-go with prepaid credits at provider list prices. Token rates carry no markup, but credit purchases include a 5.5% fee with a $0.80 minimum. A free tier provides rate-limited access to selected models.
3. LiteLLM
Best for: Organizations that need an open-source gateway within their own infrastructure.
LiteLLM combines a Python SDK with a self-hosted, OpenAI-compatible proxy for 100+ models. Its router handles load balancing, fallbacks, and caching, and virtual keys define budgets, model access, rate limits, and spend tracking for individual users or workloads. Running the proxy within private infrastructure keeps gateway traffic and storage under local control, but production deployments require ownership of replicas, PostgreSQL, Redis, monitoring, and upgrades.
Pros:
- Open-source proxy for 100+ models
- Self-hosted deployment
- Virtual keys, budgets, and rate limits
- Load balancing, fallbacks, caching, and spend tracking
Cons:
- High-availability deployments require operational ownership
- Audit logs and advanced identity controls require Enterprise
Pricing: Free and open source for self-hosted use, with custom enterprise pricing for hosted management and enterprise features.
4. Vercel AI Gateway
Best for: Applications using the Vercel AI SDK that need hosted routing at provider list prices.
Vercel AI Gateway routes requests across hundreds of models through the AI SDK, OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages interfaces. Automatic retries, load balancing, and provider fallback manage request reliability, and usage records capture spend, tokens, latency, and generation details. BYOK and zero data retention are available on paid plans, though the gateway remains on Vercel-managed infrastructure and does not include dataset-based evaluation or experiment comparison.
Pros:
- Hundreds of models through one endpoint
- AI SDK, OpenAI, and Anthropic-compatible interfaces
- Automatic retries, load balancing, and fallback
- Provider list pricing without token markup
Cons:
- No self-hosted deployment
- BYOK requires a paid plan and purchased credits
Pricing: New accounts receive $5 in monthly credits to start, after which usage is pay-as-you-go at provider list price with no markup, including bring-your-own-key.
5. Kong AI Gateway
Best for: Enterprises already operating Kong that want AI traffic governed through their existing API infrastructure.
Kong AI Gateway adds model-aware routing and controls to Kong Gateway and Konnect. AI Proxy places provider normalization, token rate limiting, semantic caching, semantic routing, prompt controls, PII sanitization, audit logs, and cost metrics under existing services, routes, consumers, and workspaces. Deployment options include Konnect, hybrid, self-hosted, DB-less, and Kubernetes configurations, with additional plugins covering MCP traffic, A2A communication, and runtime LLM-as-judge scoring. Dataset versioning, experiment comparison, and CI release gates are outside its gateway evaluation features.
Pros:
- AI controls within existing Kong deployments
- Hosted, hybrid, self-hosted, and Kubernetes options
- Semantic routing, caching, token limits, and PII controls
- MCP, A2A, AI metrics, and LLM-as-judge plugins
Cons:
- Advanced AI plugins require an add-on or Enterprise
- Operations assume an existing Kong deployment
Pricing: Free trial for 30 days. The Plus plan is charged per gateway per month, and AI Gateway model proxying adds $100 per month for each unique LLM, with five models included. Custom enterprise pricing.
6. Cloudflare AI Gateway
Best for: Applications that need edge-based gateway controls with minimal configuration.
Cloudflare AI Gateway routes traffic to more than 20 providers at Cloudflare's edge, applying caching, rate limits, retries, model fallback, logging, and spend analytics. Its REST API accepts OpenAI Chat Completions, OpenAI Responses, and Anthropic Messages formats, and Guardrails and DLP inspect prompts and responses for harmful or sensitive content. Persistent logs record provider, token, cost, duration, request, and security data under plan-specific storage limits. Cloudflare's built-in evaluations are deprecated and unavailable to new accounts.
Pros:
- Edge routing across 20+ providers
- OpenAI and Anthropic-compatible interfaces
- Caching, rate limiting, retries, and model fallback
- Inline Guardrails and DLP checks
Cons:
- Evaluations are unavailable to new accounts
- Persistent log storage is capped by plan
Pricing: Core gateway features are free with a Cloudflare account.
Portkey alternatives compared (2026)
| Criterion | Portkey | Braintrust | OpenRouter | LiteLLM | Vercel AI Gateway | Kong AI Gateway | Cloudflare AI Gateway |
|---|---|---|---|---|---|---|---|
| OpenAI SDK compatibility | ✅ OpenAI-compatible Universal API | ✅ OpenAI, Anthropic, and Gemini SDKs work across providers | ✅ OpenAI-compatible API | ✅ OpenAI-compatible proxy | ✅ OpenAI Chat, Responses, and Anthropic Messages | ✅ OpenAI-format AI Proxy | ✅ OpenAI Chat, Responses, and Anthropic Messages |
| Provider and model coverage | ✅ 1,600+ models | ✅ Major providers plus custom, self-hosted, fine-tuned, and proprietary endpoints | ✅ 500+ models across 80+ providers | ✅ 100+ model integrations | ✅ Hundreds of models | ⚠️ Major providers and configured custom endpoints | ⚠️ 20+ providers plus Workers AI |
| Caching controls | ✅ Simple and semantic caching | ✅ Encrypted response caching with three modes, per-request TTLs, and user scoping | ✅ Exact-response caching with TTL controls | ✅ Response and semantic caching through configurable backends | ⚠️ Provider-side prompt caching only | ✅ Semantic caching plugin | ✅ Exact-response caching with TTL and custom cache keys |
| Cost attribution | ✅ Model, key, workspace, and metadata | ✅ Provider, model, project, and custom metadata alongside evaluation scores | ✅ Model, provider, key, and workspace | ✅ Key, user, project, group, and tag | ✅ Model, provider, and project | ✅ Provider, model, consumer, and workspace | ✅ Provider, model, and custom metadata |
| Guardrails | ✅ Inline input and output checks | ⚠️ Online and offline scorers without inline blocking | ✅ Budget, model, provider, retention, and content policies | ✅ Built-in and third-party checks before, during, or after a call | ⚠️ Retention and provider policies without content filtering | ✅ Prompt guards, PII controls, and cloud guardrail plugins | ✅ Prompt and response Guardrails with DLP |
| Self-hosting | ✅ Open source gateway core with Enterprise deployment options | ⚠️ Enterprise only | ❌ Hosted only | ✅ Self-hosted | ❌ Hosted only | ✅ Self-hosted, hybrid, DB-less, and Kubernetes options | ❌ Cloudflare-managed edge deployment |
| Governance and RBAC | ✅ Workspaces, RBAC, and service accounts | ✅ Organization and project credentials, environments, and RBAC | ✅ Workspaces, admin and member roles, budgets, and guardrails | ⚠️ Virtual-key controls, with advanced RBAC and audit logs on Enterprise | ✅ Team and project roles, budgets, and allowlists | ✅ Workspaces, consumers, RBAC, and gateway policies | ✅ Account roles and audit logs |
| Production logs and evaluation | ⚠️ Logs, traces, feedback, evaluation datasets, and batch or integration workflows | ✅ Native path from traces to datasets, scorers, experiments, online evaluation, and CI checks | ⚠️ Activity logs, code-based Ori Eval, and trace exports | ⚠️ Request logs with evaluation through callbacks and integrations | ⚠️ Generation logs with evaluation through integrations | ⚠️ Runtime LLM-as-judge scoring without managed experiments or CI gates | ⚠️ Persistent logs; evaluations are unavailable to new accounts |
| Pricing model | ✅ Free Developer plan, $49 monthly Production plan, and custom Enterprise pricing | ✅ Gateway free during beta, free Starter plan, $249 monthly Pro plan, and custom Enterprise pricing | ⚠️ Pay-as-you-go with a 5.5% credit-purchase fee | ✅ Free open source gateway with custom Enterprise pricing | ✅ $5 monthly credit followed by provider list pricing | ⚠️ 30-day trial, then per-gateway pricing plus $100 monthly per proxied model | ✅ Free core features; Unified Billing adds a 5% credit fee |
Route across providers, inspect every call, and turn production traces into repeatable evaluations with Braintrust. Start free.
Migrating off Portkey
Moving off Portkey requires moving the gateway configuration, access controls, prompts, and retained data in a controlled sequence before production traffic changes endpoints.
Step 1. Inventory the Portkey configuration
The migration inventory should record provider credentials, virtual keys, gateway configs, prompt templates, guardrails, budgets, rate limits, and workspace permissions. Each item needs a destination in the replacement gateway so routing and governance behavior remain accounted for during cutover.
Step 2. Recreate credentials and access scopes
Configure provider credentials at the corresponding organization, project, or application scope. New application-facing keys can then inherit the required model access, budgets, and rate limits without exposing raw provider credentials.
Step 3. Translate routing and caching rules
Rebuild each gateway config with the same provider order, fallback conditions, load-balancing weights, retries, timeouts, conditional routes, and caching rules. Also verify streaming, tool calls, multimodal requests, and provider-specific parameters, since OpenAI compatibility does not guarantee identical behavior for every request type.
Step 4. Move prompts and policy controls
Versioned prompt templates should retain their variables, model settings, and active production version. Guardrails, budget limits, rate limits, and RBAC policies also need their original scope and execution point, including whether a check runs before a provider call, after a response, or asynchronously.
Step 5. Export required historical data
Export logs, traces, feedback, and metadata needed for compliance reviews or debugging before Portkey's retention window removes older records. Config IDs, trace IDs, cache results, retry attempts, and fallback events may also be necessary when historical incidents must remain reproducible.
Step 6. Validate traffic before the final cutover
OpenAI-compatible endpoints usually reduce application changes to a base URL and API key swap, but a representative traffic sample should pass through the new gateway first. With Braintrust Gateway, the comparison can cover responses, latency, cost, cache status, provider selection, and evaluation scores within logged traces. Full cutover follows once routing and observability meet the acceptance criteria, with Portkey retained through the defined rollback window.
How to pick a Portkey alternative
Braintrust fits teams that want routed production traffic to double as evaluation evidence. Each call enters the same tracing and evaluation system, where production behavior can become scored datasets, comparable experiments, and CI checks.
OpenRouter makes broad model access easier when developers need to test many models without opening and funding accounts with every provider. One API key and credit balance cover its hosted catalog, and routing policies can select endpoints according to price, latency, throughput, or data handling.
LiteLLM suits organizations that want the gateway code, runtime, and data stores inside their own infrastructure. The open-source proxy exposes routing and access controls directly, and engineers retain control over deployment, scaling, and configuration.
Vercel AI Gateway is useful when applications already use the Vercel AI SDK and Vercel projects. Model access, spend reporting, and deployment permissions remain under the same account structure, reducing the administration required for an independent gateway account.
Kong AI Gateway aligns with organizations that use Kong for API management. Existing services, routes, consumers, authentication, and policy configuration also govern model, MCP, and A2A traffic.
Cloudflare AI Gateway belongs where model traffic passes through Cloudflare's network today and edge controls are the main requirement. Caching, rate limits, retries, fallback, Guardrails, and DLP remain under the same Cloudflare account and request path.
Why Braintrust leads as a Portkey alternative
Braintrust stays independent where Portkey now sits inside a security suite, and it treats gateway traffic as raw material for release decisions. Routed requests connect with the evaluation criteria used before deployment, creating a continuous path from live failures to regression coverage and CI approval.
Notion uses Braintrust to keep 70 engineers aligned on evaluations and deploy new frontier models in under 24 hours. Notion's process starts with production traces, converts important failures into targeted datasets, and runs regression and frontier evaluations before release. Organizations adopting Braintrust can apply the same sequence to shorten model rollouts without weakening quality checks.
Connect production traces to release decisions with Braintrust.
FAQs: Portkey alternatives in 2026
What is an AI gateway?
An AI gateway is a proxy between an AI application and one or more model providers. Applications send requests to a single endpoint, where the gateway authenticates access, selects a model or provider, applies retries and fallbacks, enforces rate limits and budgets, caches eligible responses, and records cost, latency, errors, and usage. Centralizing these controls keeps provider credentials and routing policies out of individual applications.
Is Portkey still available as a standalone product after the Palo Alto Networks acquisition?
Portkey continues to operate, but its website now presents it as Prisma AIRS AI Gateway within Palo Alto Networks. Buyers seeking Portkey as a standalone product should confirm current contracting, deployment, and roadmap terms with Palo Alto Networks.
What is the best open-source Portkey alternative?
LiteLLM is the strongest open-source Portkey alternative for organizations that want to operate the gateway in their own infrastructure. Its OpenAI-compatible proxy covers multi-provider routing, virtual keys, access controls, budgets, rate limits, caching, and usage tracking. LiteLLM also includes a Braintrust callback, so routed requests can be sent to Braintrust for tracing and evaluation while LiteLLM continues to handle self-hosted routing.
How do OpenRouter and LiteLLM compare as Portkey alternatives?
OpenRouter is a hosted gateway that combines access to hundreds of models under one API key and billing account. LiteLLM is a self-hosted proxy that connects to existing provider accounts and keeps the gateway runtime under internal control. OpenRouter removes infrastructure management, and LiteLLM offers greater control over deployment and configuration. Our Braintrust vs OpenRouter comparison covers the hosted-marketplace tradeoff in more detail.
What should teams migrate when leaving Portkey?
Migrate provider credentials, application keys, model aliases, routing and fallback rules, rate limits, caching policies, prompt versions, guardrail configurations, and any logs required for audits or regression testing. Behavior checks belong in the same pass, since OpenAI compatibility does not guarantee identical handling of streaming, tool calls, or provider-specific parameters.
Is Braintrust better than Portkey?
Braintrust pulls ahead when gateway traffic needs to feed tracing, datasets, evaluations, and release checks. Production requests can be evaluated against defined quality criteria before model or routing changes reach users. Portkey is stronger when inline blocking guardrails are the primary requirement.