What API management really costs when you choose build, partner or SaaS
The cost of API management depends on three things: how much traffic the gateway carries, who operates it, and how much plugin, identity and developer portal work the estate needs. Those three factors decide whether running Apache APISIX or Kong Gateway yourself, hiring a partner, or buying a managed platform costs less over three years, and the answer changes as partners and internal teams add APIs. The open-source gateways carry no license fee for the core product, so most of the spend moves into infrastructure, engineering time and support.
Be precise about what "free" covers. Apache APISIX is released under the Apache-2.0 license, and Kong Gateway's open-source repository is also Apache-2.0 licensed. However, Kong's pricing page places fully self-hosted gateways, with both control plane and data plane hosted locally, in its separate Kong Gateway Enterprise offering, priced through its commercial team. Kong's OpenID Connect plugin is also Enterprise-tier, so an open-source Kong deployment would need a different route to OIDC. Apigee charges per API call by proxy type, listing $20 per million Standard API Proxy calls and $100 per million Extensible API Proxy calls for the first 50 million calls, plus hourly environment charges and Google Cloud networking. Kong Konnect's Plus plan starts at $25 per month plus usage. Ask each vendor for the Enterprise or Konnect price at your projected call volume, not the list entry price.
Before comparing quotes, build a cost model with three columns: fixed (compute, etcd or database, load balancers, monitoring, backups), variable (per-call fees, egress, environment charges), and people (who writes plugins, maintains the portal, handles upgrades and answers partner tickets). Per-call pricing scales linearly with traffic, so a partner-heavy estate with bursty batch traffic can cost far more on a metered platform than on a self-run cluster. Self-run costs rise with operational headcount and upgrade cadence instead. Confirm with any partner whether the fixed price includes plugin development, portal setup, and a named upgrade plan, and whether those costs recur each year.
Cost components for build, partner and SaaS options
This table compares who pays for each cost component under three models: running open-source APISIX or Kong yourself, engaging a partner to run the gateway, or buying a managed API platform. Read each row for who is paid, whether the cost is one-time or recurring, and what moves it up or down. The main takeaway is that open-source software removes the license line but not the infrastructure, plugin, identity and operations work, which stays with someone under every model.
| Cost component | Build (run in-house) | Partner-run or SaaS |
|---|---|---|
| Infrastructure | Recurring. Your cloud or data center bill for gateway nodes, etcd or database, load balancers and logging. Sized by traffic and high availability design. | Partner-run: recurring, usually billed to you by the partner, confirm whether hosting sits in your accounts. SaaS: recurring, bundled into the subscription or metered by usage. |
| Software licensing | APISIX is Apache-2.0 with no license fee. Kong Gateway Enterprise features, such as the OpenID Connect plugin, require a commercial license priced through Kong's sales team. | Partner-run: recurring fee for the partner's services and any enterprise license they resell. SaaS: Apigee charges $20 per million Standard API Proxy calls and $100 per million Extensible API Proxy calls after the first 50 million calls (Apigee pricing page). Kong Konnect Plus starts at $25 per month plus usage (Kong pricing page). |
| Plugin and identity integration | One-time build plus recurring upkeep. Wiring OIDC to Keycloak, Entra ID or Okta, and writing custom plugins, is engineering time you own. | Partner-run: usually one-time setup in the statement of work, then recurring change requests. SaaS: identity connectors may be included or priced as an add-on, confirm before signing. |
| Developer portal | One-time build, recurring hosting and content upkeep. Confirm whether your gateway tooling includes a portal or whether you need a separate product. | Partner-run: portal setup is one-time, hosting and onboarding support recur. SaaS: often included in higher tiers, confirm the tier that includes it and any per-developer limits. |
| Upgrades and patching | Recurring internal labor. Track the release line you run; Kong Gateway Enterprise lifecycle dates differ by version, so check the version support policy before choosing a line. | Partner-run: recurring, specify in the contract who tests and rolls out upgrades. SaaS: the provider handles upgrades, but you still pay for regression testing of your routes. |
| Monitoring and on-call | Recurring staff cost for 24x7 coverage, alerting and capacity management. Often the largest hidden line in a self-run gateway. | Partner-run: recurring, check response targets and escalation paths in writing. SaaS: vendor runs the platform, you still staff internal incident response for your APIs. |
| Support | Recurring for community support or internal expertise. Commercial support is an additional recurring line for Kong or other vendors. | Partner-run: recurring retainer, scope and response levels are set in the agreement. SaaS: recurring subscription tier; ask which tier includes priority support. |
| Usage growth | Costs rise with nodes and storage as call volume grows. Plan capacity tests before traffic peaks. | Per-call pricing rises with volume. Model expected calls by proxy type and ask for a quote at your forecast volume before committing. |
How per-call pricing scales as traffic grows
Per-call pricing grows in a straight line with traffic, so the first cost model to build is calls per month multiplied by the rate for each proxy type. Apigee's pay-as-you-go pricing lists $20 per million Standard API Proxy calls and $100 per million Extensible API Proxy calls for the first 50 million calls, according to the Apigee pricing page. As an illustrative calculation only, a platform handling 100 million Standard proxy calls a month would pay about $2,000 in call charges, while the same volume on Extensible proxies would pay about $10,000. Doubling traffic doubles the call line, and the rate tier and proxy type you choose decide which multiplier applies.
Call charges are not the whole bill. The same pricing model adds hourly charges for each environment and Google Cloud networking usage, and both recur for as long as the gateway runs, including in non-production environments. Confirm with the vendor how tiers change above the first 50 million calls, how peak hours are billed, and whether retries, health checks and failed requests count as billable calls. Ask for a worked example that uses your own environment count and data transfer, not a generic one.
A self-hosted gateway such as Apache APISIX or Kong Gateway has no per-call line item. Its cost grows with the compute needed to hold your peak request rate, the number of nodes you run for availability, and the people who operate, patch and upgrade the gateway. Model your own call volume, peak requests per second, proxy types and environment count against the vendor pricing page, then compare that with the fixed cost of infrastructure and operations. Also confirm which gateway features your plan needs, since Kong's OpenID Connect plugin is an Enterprise tier feature and changes the comparison.
What moves the API management cost up or down
The licence line is rarely the largest number in an API management budget. The drivers below decide how much infrastructure, engineering and support time a self-hosted gateway needs, and how much a per-call or subscription platform charges as usage grows. Check each one against your own estate before comparing quotes.
Call volume and peak traffic
Self-hosted cost follows capacity: the nodes, load balancers and database or etcd clusters you must size for peak traffic, not average traffic. Per-call pricing follows volume directly. Apigee's pay-as-you-go model charges per million calls by proxy type, so a higher call count raises the bill linearly. Ask a partner for a sizing estimate at peak and at growth, and ask a managed vendor to price the same peak load.
Environments and regions
Each environment (development, test, staging, production) and each region multiplies the gateway nodes, control plane components and monitoring you run. Multi-region gateways add replication and failover work that a single-region deployment does not carry. Managed platforms often charge hourly for environments on top of call fees. Ask who provisions and patches each environment, and whether non-production environments can run at reduced scale.
Deployment mode and control plane
The deployment topology sets how many moving parts you operate. APISIX offers traditional, decoupled and standalone modes, and Kong offers traditional, DB-less and hybrid topologies. Traditional and decoupled modes add an etcd or database cluster to run and back up. Standalone and DB-less modes remove that dependency but push configuration management into Git and release pipelines. Kong Konnect is a cloud control plane with a usage-based plan, so a hybrid design changes who runs the control plane and what it costs.
Identity provider integration and Enterprise plugins
Authentication is where open source and commercial gateways diverge. APISIX ships an openid-connect plugin that works with Keycloak, Okta, Microsoft Entra ID and others. Kong's OpenID Connect plugin sits in the Enterprise tier and is not part of the open source gateway. Budget for the commercial licence if you need that plugin, and budget engineering time for each identity provider mapping, token validation rule and PKCE or client credentials flow your partners use.
Developer portal and partner onboarding
A developer portal, key issuance, plan management and partner self-service are often the largest build items after the gateway itself. Open source gateways do not include a commercial portal, so you either build one, buy one, or accept manual onboarding. Each onboarding workflow, documentation set and support queue recurs as headcount. Ask each vendor what is included in the quote, what is an add-on, and how many partners the price assumes.
Plugin development and upgrade work
Custom plugins written in Lua, Go, Java, Python or WebAssembly, and each gateway version upgrade, carry recurring engineering cost. Kong's version policy shows that Enterprise lines reach end of support on fixed dates, so an upgrade calendar must be funded. Confirm who writes, tests and maintains custom plugins after handover, and whether the partner's retainer covers version upgrades or only incident response.
Compliance evidence and log retention
Keeping access logs and audit trails for longer periods increases storage, retention and search costs, whether you self-host or pay per event in a managed platform. Regulated APIs may need evidence retained for a defined period and reviewed by auditors. Ask which logs the gateway emits, where they are stored, who owns the retention policy, and whether the vendor's pricing charges for log volume.
Which option fits which operating model
Your own platform or API team installs, configures and operates Apache APISIX or Kong Gateway inside your cloud accounts or data centers. Software licensing is zero for APISIX, which is Apache-2.0 licensed, while Kong's fully self-hosted control plane and data plane sit in the separate Kong Gateway Enterprise offering, priced through Kong's commercial team. Most of the spend is people and infrastructure.
- Team skills: Gateway administration, NGINX or Kubernetes operations, etcd or database operations for the chosen mode, and identity integration with your provider.
- What you control: Routes, plugins, certificates, upgrade timing and the Admin API, along with the audit trail of who changed what.
- Where data and configuration live: Entirely in your environment, including logs and the configuration store.
- Main recurring cost: Engineer time for on-call, plugin and portal work, and patching, plus compute for the data plane and control plane.
- Upgrade plan: Kong Gateway 3.9 reached end of full support on December 12, 2025 and reaches end of sunset support on December 12, 2026, per Kong's version support policy. LTS lines 3.10 and 3.14 are supported until March 31, 2028 and April 7, 2029. Budget the move to a supported line as a recurring item.
Confirm with each vendor which features your chosen tier includes before you commit to a plan.
An implementation partner deploys and operates the gateway on infrastructure you own, under a written scope. You still own the cloud accounts, keys and data, while the partner supplies the engineers who run the platform, handle upgrades and respond to incidents. The commercial terms are usually a fixed implementation fee followed by a recurring support agreement, and both should be defined in writing before work starts.
- Team skills: Your team needs enough knowledge to approve changes, review access and act as the owner of each API, while the partner covers gateway engineering.
- What you control: Final sign-off on routes, identity mapping, policies and retention, with the option to take the platform in-house later.
- Where data and configuration live: In your infrastructure, with the partner working through agreed access paths and logging.
- Main recurring cost: The support retainer, plus your own infrastructure and the internal time needed to review partner work.
- What to ask for: A quote that separates one-time deployment, plugin and portal work from ongoing support, upgrade and testing, with the supported gateway lines and the exit terms written out.
Check how the partner handles version upgrades and whether the support retainer covers them.
A managed API platform runs the gateway and control plane for you and bills by subscription, by usage, or both. Apigee's pay-as-you-go pricing charges per API call by proxy type, listing $20 per million Standard API Proxy calls and $100 per million Extensible API Proxy calls for the first 50 million calls, plus hourly environment charges and Google Cloud networking usage, according to Google Cloud's Apigee pricing page. Kong Konnect Plus starts at $25 per month plus usage, while Enterprise is custom priced, per Kong's pricing page.
- Team skills: Less gateway operations work, but you still need API ownership, policy design and vendor management.
- What you control: Configuration through the vendor's tooling, with less control over where the runtime sits.
- Where data and configuration live: Partly in the vendor's control plane and cloud, which your data protection and residency review must cover.
- Main recurring cost: Per-call or subscription charges that rise with traffic, so model peak volumes, retries and partner calls, not averages.
- Scaling risk: Per-call pricing grows with every new partner integration and batch job, which makes a traffic forecast part of the cost case.
Ask the vendor for a written estimate at your projected peak traffic and for the terms that apply when you exit.
One-time work versus recurring operating cost
Separate the one-time build work from the recurring operating cost before comparing options, because the two behave differently over time. One-time work includes architecture and deployment mode selection, initial route and plugin migration, identity integration with your provider, developer portal setup, runbooks, and the first round of security and load testing. These costs are front-loaded and end when the gateway goes live. Recurring work includes the infrastructure that runs the data plane and control plane, upgrades, certificate and secret rotation, monitoring, on-call coverage, plugin maintenance, and any vendor subscriptions. A self-run APISIX or Kong deployment carries the full recurring list itself, while a managed platform bills most of it into its per-call or subscription fee.
Budget upgrades as a standing recurring cost, not an occasional project. The downloads page for Apache APISIX lists 3.19.0, released September 28, 2026, and does not mark any release as long-term support, so you should plan a cadence of tested upgrades rather than waiting for a support label. For Kong, check the Kong Gateway version support policy for the current LTS lines and end-of-support dates before you commit to a version, since the open-source repository and the Enterprise support lifecycle follow different timelines. Each upgrade should include regression tests for every plugin chain, since a gateway version change can alter plugin behavior that partners depend on.
When you request a quote, ask the partner to split it into one-time and recurring lines, and to state for each recurring line who performs the work and how often. Ask for the hours or fixed fee for certificate and secret rotation, the on-call model, the upgrade cycle and its test scope, and the monitoring stack that is included. Ask which items are priced per environment, per route, or per consumer, and what changes the recurring cost if partner traffic doubles. Confirm which subscriptions are required, such as Kong Konnect or Kong Gateway Enterprise for features like OpenID Connect, and whether those are billed by usage, by seat, or annually. A quote that blends these lines makes it impossible to compare a self-run gateway with a managed platform.
How to build your own API management cost estimate
This sequence turns your API estate, traffic and operating model into a cost comparison between running an open-source gateway yourself, buying partner-run operations and paying a managed per-call platform. The output is a written estimate you can test against vendor and partner quotes.
Inventory APIs and call volumes
List every API that will pass through the gateway, its owning team, its consumers (internal services, staff applications, partners and public clients) and its call volume. Record peak requests per second and monthly totals for each API and for each partner, because per-call pricing is applied to the total you send through the platform. Your API owners and traffic logs from the current gateway or load balancer are the usual sources. This step is complete when you have a table with one row per API and partner, a peak figure and a monthly figure for each, and a named owner who has signed off on the numbers.
Choose deployment mode and control plane location
Decide how the gateway will run. Apache APISIX offers traditional, decoupled and standalone modes, and Kong Gateway documents traditional, DB-less and hybrid self-managed topologies. Each mode changes how many clusters, databases or etcd components you run and how many nodes you need in each environment. Also decide where the control plane lives and whether any cloud-hosted control plane is acceptable to your security team. This step produces a one-page topology diagram that your architects and security reviewers have approved, which is the basis for every infrastructure line that follows.
List required authentication and plugins
Write down the authentication methods each API needs, such as OIDC with your identity provider, API keys, mutual TLS for partners, and token introspection, along with traffic controls, observability exports and any AI gateway functions. Check each item against the edition you plan to run. Some capabilities that are built into one gateway are Enterprise-tier features in another, so confirm the licensing position for each plugin in writing before you cost it. The output is a plugin matrix listing each API, each control and the edition that provides it.
Define environments and regions
List every environment that needs a gateway, including development, test, staging, production and any partner sandbox, and every region or data center where traffic must terminate. Each environment and region adds nodes, certificates, monitoring and upgrade work, so the count drives both infrastructure and labor. Confirm with your architects whether sandboxes need full parity with production. The step is done when you have an environment and region table with a node count assumption for each row.
Estimate infrastructure from your cloud pricing
Price the compute, storage, database or etcd, load balancers, outbound network traffic, logging and certificate services in your own cloud account or data center, using your provider's current price sheets and your negotiated discounts. Gateway software itself carries no license fee under Apache-2.0 for APISIX and the open-source Kong Gateway, so the main recurring cost is the infrastructure you run. Separate one-time setup costs from recurring monthly costs and size for peak traffic, not average traffic, with headroom your architects agree on. Ask your platform team for the monthly figure per environment.
Add operations and upgrade hours from your staff
Estimate the internal effort for on-call coverage, configuration changes, plugin development, certificate rotation, security patching, gateway version upgrades, backup testing and developer onboarding. Use your own staff rates and the hours each task has taken on comparable platforms in your environment. If you plan to buy partner-run operations, use the same task list to compare what you would pay a partner against what your team would absorb. The output is a recurring labor line with a named role for each task, so the estimate shows who carries the work.
Price any Enterprise-tier features
For each item on the plugin matrix that the open-source edition does not include, request a written quote from the vendor or its commercial team. Kong's pricing page states that fully self-hosted gateways with both control and data planes local belong to the separate Kong Gateway Enterprise offering, priced through its commercial team. Ask for the metric the price is based on, whether it is per node, per instance or per workload, and whether support and upgrades are included. Record each quote as a separate line so you can remove it if the requirement changes.
Compare against SaaS per-call models using your volume
Take the monthly and peak call volumes from step one and apply them to each managed platform's pricing model. Apigee's pay-as-you-go pricing, for example, charges per million API calls by proxy type, plus hourly environment and networking charges, so the bill rises with traffic and with the number of environments. Subscription plans, such as Kong Konnect Plus, are priced differently and bill usage on top of a base fee. Run the comparison at your peak and at a volume you expect to reach within your planning horizon, and request written scope from each managed provider and partner that states what is included, what is metered and what triggers extra charges. Illustrative example: if a per-million-call price applies to a 60 million monthly total, the bill scales linearly with any growth in that total, so the same comparison should be repeated at each planned volume tier.
Questions buyers ask about API management cost
Does the open-source API gateway itself cost money to use?
The software license for Apache APISIX is free under Apache-2.0, and the open-source Kong/kong repository is also Apache-2.0 licensed. The money goes elsewhere: the infrastructure that runs the gateway, the etcd or PostgreSQL databases behind it, the time your engineers spend on configuration, plugins, upgrades and monitoring, and any paid support contract you choose. Kong's self-managed control plane and data plane features sit in the separate Kong Gateway Enterprise offering, which is priced through Kong's commercial team, so confirm which edition a quote covers before comparing it with a free deployment.
How long does a self-hosted API gateway take to stand up, and what does it need?
No duration is fixed for this work, because it depends on how many APIs you have, how many environments you run, and how much of your identity and logging setup already exists. The buyer typically provides cloud or data center capacity, network paths to the back-end services, a identity provider for token validation, a logging destination, and people who own the routes and policies. Start by confirming the deployment mode you need: APISIX offers traditional, decoupled and standalone modes, and Kong offers traditional, DB-less and hybrid topologies. Each choice changes the infrastructure and the operational effort.
Can our own team run an API gateway without an implementation partner?
A team with platform engineering experience can run a gateway itself, but the work is ongoing rather than a one-time install. Someone must own upgrades, since Kong Gateway 3.9 reaches end of sunset support on December 12, 2026 under Kong's version support policy, and APISIX releases such as 3.19.0 are not marked as long-term support on its downloads page. Plan for configuration in Git, certificate rotation, plugin testing and on-call coverage. Many buyers keep the gateway in-house and bring in a partner only for the initial design, the identity integration or the periodic security testing.
How does per-call API gateway pricing compare at high volume?
Per-call pricing grows with traffic, while self-hosting costs grow with capacity and people. Google's Apigee pay-as-you-go pricing lists $20 per million Standard API Proxy calls and $100 per million Extensible API Proxy calls for the first 50 million calls, plus hourly environment charges and Google Cloud networking usage. For a fixed traffic forecast, model both curves: the per-call total at your peak volume, and the self-hosted total for servers, databases, monitoring and staff time. Ask any vendor to show the calculation at your projected volume, including traffic that a rate limit would reject.
What do Enterprise-tier plugins and self-hosted control planes add to the bill?
They add license fees and sometimes a different architecture. Kong's OpenID Connect plugin is an Enterprise tier plugin, so it is not part of the open source gateway, and fully self-hosted control and data planes belong to Kong Gateway Enterprise, which is custom priced. APISIX's openid-connect plugin ships with the Apache-2.0 project, which changes the comparison for OIDC-heavy designs. Before you decide, list every plugin your policy needs, mark which tier includes it, and ask the vendor to confirm current pricing in writing, because plan details can change.
What should a partner quote for API gateway work include?
A usable quote lists the scope in writing before any work starts, which most fixed-scope engagements follow. Ask for the deployment design and the environments covered, the number of APIs and routes in scope, the authentication flows and identity provider integration, the plugins and any custom plugin work, the observability and logging setup, the developer portal or partner onboarding if included, the documentation and runbooks, and the upgrade and support model. Separate one-time build costs from recurring support, infrastructure you pay directly, and any vendor license fees. DeployOpen does not publish a price list, so a quote follows from that written scope.
What to confirm with vendors and your own environment
Treat every price and feature claim in this section as unverified until the vendor confirms it in writing. Published SaaS pricing changes, and the figures on this page are only the ones we could source at the time of writing. Start with the Kong pricing page and the Apigee pricing page, then ask each vendor for a quote that states the unit being billed, the environments and regions covered, what counts as a billable call, and how overage, support and trial conversion are charged. For Kong, ask in writing which features your use case needs are in the open-source gateway and which sit in Kong Gateway Enterprise, because the OpenID Connect plugin is an Enterprise tier plugin, and a fully self-hosted control plane and data plane is priced through Kong's commercial team, not through the Konnect plans.
Next, confirm the operating terms that drive total cost. Ask for the support response times, the SLA for each tier, and what happens to security patches for the version you deploy. For Kong Gateway Enterprise, check the version support policy against the release you plan to run, since 3.9 has moved into sunset support, and confirm which LTS line the vendor recommends for a long-lived deployment. For Apache APISIX, the downloads page does not mark any release as long-term support, so ask your implementation partner which release train they will maintain and how often they will backport fixes. Ask every SaaS vendor where its control plane is hosted, which regions hold configuration, logs and analytics, and whether you can pin data residency in the contract. Your own environment matters too: confirm your cloud or data center capacity, your identity provider's support for the flows you need, and who in your organization owns the gateway after handover.
Finally, get the upgrade process in writing before you commit. Ask the vendor or partner to describe, step by step, how a gateway version moves from a test environment to production, including how configuration is versioned, how rollbacks work, whether plugin changes need a restart, and what maintenance window your traffic requires. For a self-hosted build, make sure the upgrade path is part of the scope and the quote, not an assumed later task. Record each answer in the statement of work, so the cost comparison between build, partner and SaaS rests on confirmed numbers and commitments rather than on list prices and assumptions.
How DeployOpen scopes and delivers a fixed-scope gateway implementation
DeployOpen plans, implements, hardens, documents and supports self-hosted gateways inside the client's own cloud accounts, data centers or air-gapped networks. For API management cost, that means turning the build, partner or SaaS question into a written scope with line-item deliverables before any work starts.
How we scope
- We agree the written scope before work starts, listing the APIs, plugins, identity integrations and environments in it.
- Scope separates one-time items such as deployment, plugin work and portal setup from recurring operations and support.
- We ask for the traffic volumes, per-call assumptions and partner counts that a fair cost comparison depends on.
How we build
- We deploy APISIX or Kong in the topology the client chooses, such as traditional, decoupled, standalone, DB-less or hybrid.
- We configure authentication, rate limits and observability against the client's identity provider and logging stack.
- We keep gateway configuration under version control and test it against the OWASP API risks before go-live.
How we hand over
- We deliver architecture notes, runbooks, configuration records and a list of enterprise-tier features that the scope does not include.
- We train the client's operators on upgrades, certificate rotation and plugin changes so the team can run the gateway without us.
- We document which licenses and subscriptions the client must hold, so the total cost of ownership is visible from day one.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, priced separately from the implementation.
- Retainers can cover version upgrades and security patches for the chosen gateway release line.
- We review cost drivers with the client at agreed points, such as traffic growth, new partners or a new deployment region.
