“Do we need an API gateway?” It depends less on the product than on which problems you actually have, and the cost of getting it wrong ranges from a few pounds a month to a few thousand.

What a gateway does

An API gateway is the single front door to your services. Requests arrive at the gateway; it decides what to do with them before anything reaches your code.

The common jobs:

  • Routing. /orders goes to one service, /users to another.
  • TLS termination. Certificates are handled in one place.
  • Authentication. API keys, JWT validation or OAuth, checked once at the edge rather than in every service.
  • Rate limiting and quotas. Protect your backend and enforce plan limits.
  • Request and response transformation. Headers, versioning, protocol translation.
  • Observability. One place to log, measure and trace every call.
  • Developer portal and monetisation. Documentation, key issuance and billing for external API consumers. Where “gateway” turns into “API management”.

Most small teams need the first four. Very few need the last.

Where it sits

There are four broad places to put this function, in rising order of complexity:

  1. A reverse proxy you already run. Caddy, Nginx or Traefik in front of your services. Routing, TLS and basic rate limiting come free; authentication needs a plugin or a few lines of config.
  2. A self-hosted gateway. Kong Gateway (open source) or KrakenD Community Edition (Apache 2.0) on your own instances. More features, a plugin ecosystem, still yours to run.
  3. A managed cloud gateway. AWS API Gateway, Google Cloud API Gateway, or an edge platform such as Cloudflare Workers. No servers, priced per request, tied to that provider.
  4. A full API management platform. Apigee or Kong Konnect: policies, analytics, developer portals, monetisation, with pricing to match.

Complexity

Option Setup effort Ongoing effort Lock-in Best fit
Reverse proxy (Caddy, Nginx, Traefik) Hours Low: patching, config in Git None One app, a few services, internal or first-party clients
Self-hosted gateway (Kong OSS, KrakenD) Days Medium: upgrades, HA, plugin config Low Several services, real auth and rate-limit needs, cost-sensitive
Managed cloud gateway (AWS, GCP, Cloudflare) Hours to days Low Medium to high Serverless backends already on that provider, spiky traffic
API management platform (Apigee, Konnect) Weeks Medium, plus a vendor relationship High Public APIs sold to third parties, portals, monetisation

Run cost

Request-related cost per month at list prices (checked 1 October 2026). Prices are shown in the provider’s own currency. This table excludes egress, logging, tax and free-tier credits; egress follows below.

Option 5M requests/month 50M requests/month 300M requests/month
AWS API Gateway, HTTP API $5 $50 $300
AWS API Gateway, REST API $18 $175 $1,050
Google Cloud API Gateway $9 $144 $894
Apigee pay-as-you-go, Base environment $465 $1,365 not available
Kong Konnect Plus (serverless) $825 not available not available
Cloudflare Workers Paid $5 $17 $92
Self-hosted on Scaleway (2 × PLAY2-PICO + LB-S load balancer) €38 €38 €38

Check them yourself: AWS API Gateway, Google Cloud API Gateway, Apigee, Kong Konnect, Cloudflare Workers, Scaleway Instances and Scaleway Load Balancer.

How to read it:

  • Per-request pricing is cheap until it isn’t. AWS’s HTTP API is the bargain of the managed options; its REST API, which many tutorials still default to, costs 3.5 times as much per request.
  • API management platforms have a floor. Apigee’s Base environment starts at $365 a month before a single call, and caps at 50 requests a second, about 130M a month. Kong Konnect Plus costs $25 a month for a serverless gateway, which includes 1M requests, then charges $200 for each additional million and stops at 10M a month.
  • Self-hosting is flat. Two PLAY2-PICO instances at about €10.42 a month each and an LB-S load balancer at about €16.79 cost the same at 5M requests as at 300M. The instances sit on a free private network behind the load balancer, so they don’t need public IPv4 addresses; if you give them one, add about €2.92 a month each. That 300M is an average of about 115 requests a second, comfortably within what a lightweight proxy handles on modest hardware, though you should load-test your own traffic before relying on it.
  • Edge workers are surprisingly cheap. Cloudflare’s Workers Paid plan includes 10M requests for $5 and charges $0.30 per million after that, and doesn’t charge for egress. CPU time is billed separately, so a gateway doing heavy work per request will cost more than this. You write the gateway logic yourself, so treat it as a programmable proxy rather than an off-the-shelf gateway.

Then add egress…

Egress is the charge for data leaving the provider, and it has always been the elephant in the room with AWS and the other hyperscalers. It rarely shows up on a pricing page headline, and it’s designed to scale with your success.

Here’s the same comparison with an assumption of 10 KB per average response, which is modest for a JSON API. That’s 50 GB a month at 5M requests and 3,000 GB at 300M.

Option 5M: egress / total 50M: egress / total 300M: egress / total
AWS API Gateway, HTTP API $4 / $10 $45 / $95 $270 / $570
AWS API Gateway, REST API $4 / $22 $45 / $220 $270 / $1,320
Google Cloud API Gateway $5 / $14 $52 / $196 $315 / $1,209
Cloudflare Workers Paid $0 / $5 $0 / $17 $0 / $92
Self-hosted on Scaleway €0 / €38 €0 / €38 €0 / €38

AWS charges $0.09 per GB and Google Cloud $0.105 per GB within Europe on its premium tier. Cloudflare doesn’t charge for egress on Workers, and Scaleway’s list prices include it. The AWS figures ignore its free allowance of 100 GB a month, which covers the whole 5M column but barely dents the 300M one. On AWS’s HTTP API, egress almost doubles the bill at every volume. Larger responses, file downloads or a chatty mobile app make it worse.

The Scaleway setup has bandwidth limits rather than a meter: 100 Mbps per PLAY2-PICO instance and 200 Mbps on the LB-S load balancer. 300M requests at 10 KB averages about 9 Mbps, so there’s headroom, but plan for your peaks rather than your average.

And then the shopping basket…

The gateway is rarely the only line item. Turn on access logging and every request becomes a log entry, billed for ingestion and again for storage. Add metrics, tracing, a WAF, a cache, a custom domain, a private endpoint. Each one is a small item and each looks reasonable on its own, like dropping things into a shopping basket. The total at the till is what surprises people, and it grows with your traffic.

Before choosing, list every add-on you’ll actually switch on and price the basket, not just the headline item. Sample your logs, or keep only errors and slow requests.

Avoiding lock-in. A managed gateway’s configuration doesn’t move. If you want to be able to change provider in the future, keep routing and auth rules in code you can port, and don’t build business logic into gateway policies.

Running it yourself takes some ongoing attention: patching, certificates, upgrades, a second instance for availability. How much that’s worth depends on your team, so I haven’t put a number on it. With infrastructure in code and a managed load balancer in front, it’s less than people expect.

What I’d pick

  • One product, a handful of services, your own frontend as the main client: a reverse proxy. You may never need more.
  • Several services, external API consumers, real rate-limit and key management: a self-hosted gateway on cheap European instances, or AWS’s HTTP API if you’re already serverless on AWS.
  • Very spiky or global traffic, small team: an edge platform.
  • You sell API access to third parties and need portals and billing: now an API management platform earns its price tag, and not before.

Most people I’ve talked to are in the first two groups and are being sold the fourth.

If you’re not sure which group you’re in, it’s one of the questions a Cloud Health Check answers.