When selecting an API gateway, evaluate three primary operating and support models. Note that these categories often overlap (e.g., a vendor may offer a managed service built on open-source software).
1. Cloud-Managed API Gateways
Best for teams wanting to reduce infrastructure management and those already heavily integrated into a specific cloud provider.
- Benefits: Provider-managed availability, upgrades, and capacity; integrated identity, monitoring, and networking; usage-based billing.
- Evaluation Criteria: Check if the control/data planes are portable across environments, evaluate the cost of data transfer/logging at scale, and verify available extension points for custom policies.
2. Open-Source API Gateways
Best for teams requiring visibility into implementation, deployment flexibility, and the ability to extend the software.
- Benefits: Access to source code; ability to self-host on VMs, containers, Kubernetes, or on-premises; community-driven integrations.
- Operational Responsibilities: You are responsible for scaling the data plane, applying security updates, protecting configuration stores, and managing backups/monitoring.
3. Commercial API Gateways
Best for organizations requiring vendor support, contractual service commitments, and packaged governance/analytics tools.
- Benefits: Contractual support; packaged administration and developer portals; tested enterprise-grade integrations.
- Evaluation Criteria: Check pricing models (per request, per instance, etc.), feature availability in different editions, and whether the data plane remains operational if the hosted control plane is lost.
