API key management platform comparison: what 6 tools actually cost

I spent a morning with six pricing pages open, trying to answer one question a customer had asked me: what does this actually cost at a million requests a month?

I could not answer it. Not because the pages hide their numbers (most publish real ones) but because no two vendors price the same thing. One charges per request routed through its gateway. One charges per key verification. One charges per event stored. One does not sell a monthly allowance at all, it sells a ceiling of requests per minute. Any API key management platform comparison that flattens those into a single row of checkmarks will hand you a bill that surprises you in month three.

So here is the comparison I wanted that morning. Every price below was read off the vendor's own pricing page on 28 July 2026 and priced at one identical workload, chosen because every vendor in this list publishes an exact, purchasable number at that volume. No extrapolation, no "starting from". Where a vendor does not publish a price at all, I say that instead of guessing.

One disclosure, since it affects how you should read the table: ReqKey is in it. I have tried to keep the numbers straight by sourcing every one of them to a page you can open yourself.

Why an API key management platform comparison is wrong before it starts

These products get lumped together because they all touch API keys. They are not substitutes. The useful question is not "which has more features" but where does this thing sit relative to a request? There are three answers, and the answer determines both your latency and your invoice.

In the path. Kong Konnect and Zuplo are gateways. Traffic goes to them, they authenticate and rate limit and transform it, then they forward it to your service. They are carrying your bandwidth and your uptime, which is why they charge the most per request and why they can offer an SLA on the hop.

Beside the path. Unkey and ReqKey are key and quota layers. Your service still terminates the request; it just asks a question first: is this key good, and does it have budget? Nothing proxies your traffic, so you keep your own routing and your own failure modes, and you take on the job of actually making the call.

After the path. Moesif and Treblle are observability and monetization layers. They see requests once they have happened. They will tell you which customer is hammering which endpoint and what to bill them, but they are not in a position to reject anything at the door.

If you have never had to draw that boundary for yourself, this four-minute explainer on what a gateway actually does is a good grounding before you spend money on one:

Here is the first thing worth internalising: the cheapest platform is almost always the one whose billing unit matches something you already count. If you cannot state your monthly number in the vendor's unit without a spreadsheet, you will misforecast, and the direction of the error is never in your favour.

The same million requests, six bills

One workload, six invoices. Assume one million API calls in a month with one key check per call. Every figure below is a price the vendor publishes for that exact volume, on a plan you can actually buy today.

Monthly cost at 1,000,000 API requests. Prices read from each vendor's public pricing page on 28 July 2026.

Platform	Sits	Bills for	At 1M/month	Biggest catch
ReqKey	Beside	Key validation or logged call	$20	Validation and logging each count toward the allowance
Kong Konnect	In path	Routed API request	$25	Plus tier stops at 10M requests/mo
Unkey	Beside	Valid request (key verification)	$75	7-day log retention on every paid tier
Moesif	After	Logged event	$132 annual $165 monthly	Free tier keeps 7 days of data
Treblle	After	Requests per minute, not per month	$233	No free plan; yearly billing only; 5 APIs
Zuplo	In path	Routed request	$925	1M is exactly the self-serve ceiling

A 46x spread for the same traffic. Almost none of that is one vendor being greedy and almost all of it is the unit. Here is how each number was reached:

• ReqKey ($20): the Pro plan is $20/mo and includes 2,000,000 requests, where the pricing page defines a request as "one key validation or one logged API call". A million calls means a million validations, well inside the allowance. Turn traffic logging on and you generate 2M billable events, which still fits, so analytics costs nothing extra at this volume. Past 2M combined you pay $25 per additional million, so the thing to watch is the combined number, not the API call count.
• Kong Konnect ($25): Plus includes 1 million API requests, and the cheapest control plane on Plus is a serverless one at $25/month. Overage past the first million is "$200/month per additional 1 million API requests/month", and hybrid ($200/mo per control plane) or dedicated cloud gateways ($500/mo plus $0.15 per GB) cost considerably more than the serverless entry point.
• Unkey ($75): the API Management plan is a price ladder and the rung that includes 1M valid requests is $75/mo. The next rungs are $100 for 2M and $250 for 10M.
• Moesif ($132): the Growth plan's slider sits at exactly 1M events at its lowest setting, showing $132/mo billed annually, or $165/mo billed monthly. The unit rate displayed at that point is $1.32 per 10,000 events, and Moesif states the rate falls as committed volume rises.
• Treblle ($233): Core is $233/mo billed yearly and is specified as 500 requests per minute across up to 5 APIs. A million calls a month averages well under that ceiling, so you are buying headroom rather than paying for the volume.
• Zuplo ($925): this one needs a paragraph of its own.

The Zuplo number deserves an explanation

Zuplo's Builder plan is $25/mo and includes 100K requests, with overage priced at "$100 per 100K". Getting to a million means nine overage blocks on top of the base, so $25 plus $900. A million is also exactly where Builder stops: the plan is capped at 1M requests a month, so this is simultaneously the price at our workload and the last month you can stay on it. Above that, the published path is Enterprise, listed as from $1,000/mo on an annual contract.

Is that outrageous? Not really, and this is exactly why single-number comparisons mislead. Zuplo runs your own TypeScript at the edge on every request. You are buying compute and a programmable proxy, not a lookup. Comparing its per-request rate to a validation call is like comparing rent to a bus fare. What you should take from it is narrower and more useful: Zuplo's self-serve pricing is built for small volumes, and the step from hobby to production is a conversation with sales, not a checkbox.

The six platforms, one at a time

Unkey

Pricing: free tier covers 150K valid requests and 1,000 API keys with 1-day log retention. Paid tiers run $25 (250K), $50 (500K), $75 (1M), $100 (2M), $250 (10M), $500 (50M) and $1,000 (100M valid requests), all with 7-day logs. Unkey also sells a separate Deploy product starting at $5/mo, which is a different thing entirely and worth not confusing with the key layer.

Strengths: the closest peer to ReqKey in shape and the most developer-legible price ladder in this list. You can look at your verification count and point at your future bill in about four seconds, which is more than can be said for most of this market.

Where it falls short: 7-day log retention on every paid tier, up to and including $1,000/mo, is thin if you ever need to answer "what did this customer do three weeks ago" during a billing dispute. The ladder is also a ladder: the jump from 2M to 10M is $100 to $250, so a traffic spike moves you a whole rung rather than metering smoothly.

Best for: teams who want key verification and nothing else, and who know their volume.

Kong Konnect

Pricing: Plus is charged per gateway per month. A serverless control plane is $25/mo, a hybrid one $200/mo, and a dedicated cloud gateway $500/mo plus $0.15 per GB of bandwidth. Plus includes 1 million API requests and charges $200 per additional million, with a hard ceiling of 10 million requests a month. Enterprise is custom and billed annually.

Strengths: it is the mature option, and the pricing page is unusually specific for an enterprise gateway. A 99.99% SLA is published on the dedicated gateway tiers. If you need protocol breadth (gRPC, Kafka, WebSockets, GraphQL) in one place, very little else competes, and the $25 entry point for a full gateway is genuinely aggressive.

Where it falls short: the pricing model has several dimensions at once (control plane type, count, request volume, bandwidth), so "what will Kong cost us" is a genuine modelling exercise rather than a lookup. The $25 figure above is the floor, and most production deployments do not run on a single serverless control plane. A self-serve tier that caps at 10M requests a month also means growth eventually forces an annual contract.

Best for: organisations that need a real gateway and have someone whose job includes owning it.

Zuplo

Pricing: free forever up to 100K requests a month with 1 day of analytics retention. Builder is $25/mo, 100K included, overage at $100 per 100K, capped at 1M requests a month, 2 developer seats, 7 days of analytics. Enterprise is from $1,000/mo on an annual contract.

Strengths: writing gateway policy as TypeScript deployed to the edge is genuinely pleasant, and the free tier is usable for a real side project rather than a demo. Their documentation is also, annoyingly for a competitor, very good.

Where it falls short: the self-serve ceiling and the overage rate that leads up to it. Builder is explicitly described as not a team plan, it holds 2 seats, and it stops at 1M requests. If your API works, you will hit that wall, and the next step up starts at four figures a month. Also: your policies are TypeScript, so a team without TypeScript fluency inherits a language along with the gateway.

Best for: TypeScript teams who want programmable edge behaviour and expect to have a procurement conversation eventually.

Moesif

Pricing: free covers 30K events a month with 7 days of data retained. Growth starts at $132/mo billed annually, or $165/mo billed monthly, covering 1M to 15M events with a full year of retention. Enterprise is custom, spanning 10M to 100B+ events.

Worth knowing: a banner across the top of Moesif's site currently states the company has been acquired by WSO2 and will operate as an independent subsidiary. That is not a reason to avoid them, but if you are signing a multi-year agreement this quarter, it is a reasonable thing to ask about.

Strengths: the deepest analytics and monetization tooling here by a distance, and a full year of retention on the entry paid plan makes every other retention number in this post look stingy. If your problem is "I need to bill customers based on complex usage", this is the category leader.

Where it falls short: it is not an enforcement layer. Moesif tells you what happened; it does not stand at the door and refuse a key that ran out of credits. Most teams pair it with something else, and then they are paying two vendors for two halves of one job.

Best for: API businesses whose hard problem is billing and customer analytics rather than access control.

Treblle

Pricing: Core is $233/mo billed yearly, covering 5 APIs at 500 requests per minute with 30-day retention. Growth and Enterprise are both custom pricing behind a demo booking.

Strengths: Treblle prices on throughput rather than monthly volume, which is unusual and occasionally exactly right. If your traffic is steady, a per-minute ceiling is easier to reason about than a monthly bucket you might burn through on the 19th. The API documentation and testing tooling bundled in are real products, not checkboxes.

Where it falls short: no free plan and no monthly billing option on the entry tier, so the cheapest way in is a yearly commitment at $233/mo. For a team evaluating three vendors, being the only one that requires an annual commitment to get past the trial is a meaningful friction. The 5-API cap on Core also binds quickly in a microservice estate.

Best for: teams with a handful of production APIs and predictable traffic who want observability plus docs in one purchase.

ReqKey

Pricing: free is $0 with 100,000 requests a month. Pro is $20/mo with 2,000,000 requests included and $25 per additional million. A request is one key validation or one logged API call, so if you run validation and traffic logging together, budget both against the same allowance. Enterprise is volume pricing. Full detail lives on the pricing page.

What it does: keys, per-consumer rate limits, and a credit system in one layer you call from your own service. Credits and rate limits are deliberately separate axes: credits meter how much a customer may consume, rate limits meter how fast, and a customer with unlimited credits can still be throttled. That distinction is covered properly in the concepts docs and in our post on where a quota actually belongs.

The integration is a call, not a proxy:

curl -X POST "https://api.reqkey.com/key/validate" \
  -H "Authorization: Bearer reqkey_your_root_key" \
  -H "Content-Type: application/json" \
  -d '{"key": "YourAPI_abc123", "credits": 1}'

Expected response for a healthy key:

{
  "valid": true,
  "requestId": "abc123xyz",
  "creditsRemaining": 4999,
  "creditsLimit": 5000
}

That credits field is a number rather than a flag, which is the part people miss. A cheap read can cost 1 and a bulk export 25, from the same customer pool, decided per endpoint. Send 0 to check a key without deducting anything.

Strengths: the cheapest way to get keys, per-consumer rate limits and credit metering in one place at this volume, and credits are a genuinely different primitive from a request-per-second cap. Nothing proxies your traffic, so your latency and failure modes stay yours.

Where it falls short: see the next section, which is its own heading because it deserves one.

Who ReqKey is not for

Three cases where you should buy something else. Better you find them here than in month two.

You want a gateway. Kong and Zuplo hand you a proxy to point DNS at; we hand you a call to make. Our SDKs ship middleware for the common frameworks, so it is usually a few lines rather than a project, but if you need protocol translation, traffic splitting or centralised policy across many teams, a key layer is not a substitute for a gateway.

You need to self-host. Tyk publishes an open-source gateway you can run yourself for free. We do not offer that, and for teams with a hard data-residency or air-gap requirement, that ends the conversation.

You want your vendor to invoice your customers. Moesif and Zuplo will run monetization for you. We meter precisely and hand the numbers to your billing system, which is the right split for most teams and the wrong one if you wanted the whole pipeline bought.

And a word on Tyk, which is not in the table

Tyk is a serious API management platform and it is missing from the pricing comparison for one reason: it does not publish prices. Core and Professional are described as usage-based and flat-rate respectively, with no numbers attached, and Enterprise is a sales conversation. Its open-source gateway is genuinely free on GitHub, which for self-hosting teams may make everything above irrelevant.

Which brings up something worth saying plainly: "contact sales" is a price. It is the price that says the vendor would like to know your headcount and funding stage before quoting. Sometimes that gets you a better deal than a public rate card. It always costs you two weeks.

The questions people actually ask

Does the free tier cover a real product, or just a demo? Depends entirely on the unit. Unkey's 150K verifications and ReqKey's 100K requests will carry a genuine early-stage product for months. Zuplo's 100K routed requests will too, until it does not. Moesif's 30K events with 7 days of retention is an evaluation tier, not an operating one. Treblle has no free plan at all.

What happens when I outgrow the self-serve tier? This is the question to ask before you integrate, not after. Zuplo's self-serve stops at exactly the volume priced above, and Kong's Plus at 10M, and both then require an annual contract. Unkey's ladder runs to 100M and ReqKey's overage is uncapped at a published rate, so neither forces a conversation. Being pushed into procurement is not a scandal, but discovering it during a growth spurt is a bad week.

Do I need a gateway at all? If you are not doing protocol translation, traffic splitting, or centralised policy across many teams, then probably not yet, and a validation call from the service you already run is less machinery to operate. If you are, a key layer will not substitute for one.

What about the 429s and error semantics? Worth checking on any platform you shortlist, because the client experience is downstream of it. We wrote about the details that most implementations get wrong in your 429 response is probably wrong.

How to choose

Three questions, in order.

1. Does it need to be in the request path? If yes, you are shopping for a gateway and your realistic list is Kong, Zuplo or Tyk. If no, a key and quota layer is cheaper, simpler, and leaves your architecture alone.

2. What unit are you already counting? Take last month's number from your own logs and price it in each vendor's unit before you fall in love with a feature list. If a platform bills on something you do not currently measure, add "instrument that" to the integration cost.

3. What is the ceiling on the plan you can actually buy today? Read the cap, not the price. A cheap tier with a 1M ceiling is not cheap if you will pass 1M this year; it is a deferred sales call with a discount attached.

If you want to see how we stack up against specific alternatives in more detail, we keep that on the compare page, and the plans and credits page covers the quota model properly.

Key takeaways

• Price the workload, not the platform. Take one real month of traffic and convert it into each vendor's billing unit. The same million requests produced bills from $20 to $925 across six platforms, and most of that spread is unit definition rather than value.
• Check the ceiling on the self-serve tier before you integrate. Zuplo's Builder stops at 1M requests a month and Kong's Plus at 10M. A cap you will pass this year is a procurement deadline hiding inside a pricing page.
• Retention is the spec nobody compares. It runs from 1 day (Unkey free, Zuplo free) to a full year (Moesif Growth) across these products. You will care about this the first time a customer disputes an invoice.
• Decide whether you need enforcement or observation. Moesif and Treblle see traffic after the fact and cannot refuse a request. If you need to stop a customer at zero credits, you need something in or beside the path.
• Count how many billable events one customer call produces. On any platform, validation and logging may each count. Ask every vendor the same question and do the multiplication yourself before you commit.

Try the arithmetic on your own numbers

The honest conclusion of a post like this is that the right answer depends on a number only you have. So go get it: pull last month's request count, then price it across the tiers above rather than trusting anyone's summary, including mine.

If a key and quota layer beside your service is the shape you want, ReqKey's free tier is 100,000 requests a month with no card, which is enough to wire up validation, watch the credit counter move, and decide whether the model fits before you pay anyone. The docs start with the concepts rather than a signup wall, and if you would rather see the integration first, the Express and FastAPI walkthroughs show exactly how few lines it is.

Sources, all read on 28 July 2026: Unkey pricing, Kong pricing, Zuplo pricing, Moesif pricing, Treblle pricing and Tyk pricing. Vendor pricing moves; check the page before you sign anything.