Unkey alternatives in 2026: what each one actually replaces

Search unkey alternatives and the top result hands you three reverse proxies.

They are good products. Tyk, KrakenD and Gravitee are all real, well-run API gateways. They are also not alternatives to Unkey in any sense that survives contact with your architecture, because Unkey is a call your service makes and a gateway is a box you put in front of your service. Swapping one for the other is not a migration. It is a re-platform, and you will find that out during the DNS cutover rather than during the evaluation.

That is the problem with this whole genre. It ranks tools on a feature grid without asking the one question that decides your weekend: what do I actually have to rewrite?

Two notes before the list. I work on ReqKey, which appears below at number one, because that is where a vendor puts their own product and pretending otherwise would insult you. Everything here is checkable, and I have linked the source for each claim so you do not have to take my word for any of it. Second: every price below was read off the vendor's own pricing page on 3 August 2026. At least one page currently ranking for this keyword lists a free-tier allowance that does not match what that vendor's own pricing page says today. Check the dates on pricing tables. Including this one, in three months.

What Unkey actually does for you

Worth being precise, because the answer determines what can replace it.

Unkey sits beside your code. Your service receives a request, holds it, makes an HTTP call to ask "is this key valid, does it have quota, is it over its rate limit," gets an answer back, and continues. Nothing about your network topology changes. No traffic is rerouted. Your framework middleware is the integration point, and that is the whole install.

Per its own repository, the platform covers key issuance and verification, globally consistent rate limiting, per-key permissions and RBAC, analytics, and audit logs. It has also grown a second product, Deploy, which hosts your API containers and is priced separately on vCPU, memory and egress. Those two product lines are easy to conflate on the pricing page and they are billed on completely different units, so read carefully if you are budgeting.

Here is the first thing worth internalising: the question is never which tool is best. It is which tool sits where your current one sits. A product that is objectively more capable but occupies a different position in your request path is not an upgrade, it is a project.

The three positions an "alternative" can occupy

Beside the path. Your code calls out and waits for a verdict. ReqKey and Unkey both live here. Integration is a middleware and an environment variable. Failure mode is a decision you configure: fail open and serve unverified traffic, or fail closed and return 503.

In front of the path. A proxy terminates the connection, applies policy, and forwards to your service. Zuplo, Kong, Tyk, KrakenD and Gravitee all live here. This is more powerful (you get routing, transformation, a developer portal, protocol translation) and it is a genuinely bigger commitment.

After the path. Tools that observe traffic and report on it but gate nothing. Moesif and Treblle live here. They are excellent at what they do and they cannot reject a request, which makes them a poor answer to "what replaces my key checker."

"Can't I just put a gateway in front and be done?"

You can, and for plenty of teams it is the right call. Be clear-eyed about what the swap actually costs, though. Moving from a beside-path call to an in-path proxy means all of the following change: your DNS or ingress config, where TLS terminates, one more hop in every request's latency budget, one more thing that can be down at 3am, your local development story (you now need the gateway running to test auth), and your per-request cost model. Your existing framework middleware becomes dead code you have to remember to delete.

None of that is a reason not to do it. It is a reason not to file it under "alternatives" as though it were a drop-in.

If you have not deployed a gateway before and want an honest primer on what one is for, IBM's explainer is ten minutes and vendor-neutral enough to be useful:

The thing no alternatives list mentions

People pick Unkey partly because it is open source. That is worth a closer look in 2026, because the repository's own README now says this:

"Unkey is not accepting external pull requests at this time."

The README explains that contributions are paused while the team focuses on platform direction and stability, that issues remain open for bug reports and feedback, that the repository "remains public and source-available so you can read the code, fork it under the terms of the AGPL, and self-host," and that the policy may be revisited later. The LICENSE file is AGPLv3 for the bulk of the tree, with some directories carrying their own package-level licenses.

Read that fairly, because it is not a scandal. You can still audit the code. You can still self-host. You are not locked out of anything you were promised. What changed is upstream: if you hit a bug and write the patch, there is currently nowhere to send it, so your fix lives in your fork forever and you own the merge conflicts.

Which brings us to the second thing worth internalising: "open source" on a comparison page is two separate questions wearing one label. The license question is "what am I allowed to do with this code." The governance question is "can I influence where it goes." Most listicles answer the first and silently imply the second. If open source was your reason for shortlisting Unkey, decide which of the two you actually needed.

The comparison table

Every figure read on 3 August 2026 from the vendor's own page. The important column is not the price, it is the one next to it.

Unkey alternatives by position, billing unit and cost. Prices read 2026-08-03.

Tool	Where it sits	One billed unit is	Free tier	Entry paid	At 1M requests/mo
ReqKey	Beside your code	one key validation or one logged call	100,000 req/mo	$20/mo	$20 (Pro includes 2M)
Unkey	Beside your code	one valid request	150,000 req/mo	$25/mo (250K)	$75 (the 1M rung)
Zuplo	In front (edge proxy)	one routed request	100,000 req/mo	$25/mo Builder	$925 ($25 + 9 × $100)
Kong Konnect	In front (gateway)	one routed API request	30-day trial	$25/mo per serverless control plane	$25 (1M included)
Tyk	In front (gateway)	not published	OSS gateway, self-hosted	not published	not published
Roll your own	Inside your code	your infra bill	n/a	n/a	Redis + Postgres + your time

Do not read that last column as a ranking. A routed request and a key validation are not the same event, and pricing one against the other is a category error that every comparison table in this space commits, including, until you read the unit column, this one. A gateway bills for carrying your traffic. A beside-path layer bills for answering a question about it. If you put a beside-path layer behind a gateway you already own, you pay both, and neither vendor's pricing page will warn you.

If you want a fuller cost breakdown across a wider vendor set, including Moesif and Treblle at a fixed workload, we did that arithmetic in what six API key management platforms actually cost.

The options

1. ReqKey

Same architectural position as Unkey: a call from your middleware, no proxy, no DNS change. The difference that matters is what gets metered. ReqKey's core unit is a credit pool held at the consumer level, not a request-per-second budget attached to a key. A consumer has a limit, a remaining, an optional shadowLimit for early warnings, a refill interval, and optional overage. Every key that consumer owns draws on the same pool, which is the seam most people actually want when a customer has five keys across three environments.

Credits and rate limits are independent axes. Credits meter how much, rate limits meter how fast, and a consumer with unlimited credits can still be throttled. A rate-limited request consumes no credits and no rate-limit quota, so a client that backs off recovers cleanly.

The raw verification call:

curl -X POST "https://api.reqkey.com/key/validate" \
  -H "Authorization: Bearer reqkey_xxx" \
  -H "Content-Type: application/json" \
  -d '{"key": "YourAPI_xxx", "credits": 1}'

{"valid": true, "creditsRemaining": 4999, "creditsLimit": 5000, ...}

Or through the Node SDK, which is what you would actually ship:

import { ReqKey, ReqKeyError } from "reqkey";

const client = ReqKey.fromEnv();   // reads REQKEY_PROJECT_KEY

try {
  const decision = await client.verify(apiKey, {
    apiId: "api_payments",
    credits: 1,
    resource: "/payments",
  });

  if (!decision.allowed) {
    // reason: invalid_key | insufficient_credits | forbidden | rate_limited | denied
    return res.status(decision.statusCode).json({ error: decision.reason });
  }
} catch (err) {
  if (err instanceof ReqKeyError) {
    // The decision never arrived. THIS is where you choose:
    // fail closed -> return res.status(503).json({ error: "auth_unavailable" });
    // fail open   -> log it and continue unverified.
    return res.status(503).json({ error: "auth_unavailable" });
  }
  throw err;
}

Note the reason enum rather than a bare boolean. Out of credits (402) and going too fast (429) are different problems with different fixes, and collapsing them into valid: false guarantees a support ticket. Note also that the catch block is not decoration: it is the fail-open/fail-closed decision from earlier, written down in the one place it actually gets made. The error reference has the full status matrix, and there are drop-in adapters for Express, Fastify, Koa, NestJS and Next in the Node SDK docs.

Pricing: Free is $0 for 100,000 requests/month. Pro is $20/month with 2,000,000 included and $25 per additional million. One request is defined as "one key validation or one logged API call," which means that if you run the SDK in its default mode (validate plus analytics), one customer request costs you two. Worth doing that multiplication before you pick a tier rather than after.

Who ReqKey is not for. Three honest disqualifiers:

• You want a gateway. We do not proxy your traffic, route it, transform it, or serve a developer portal. If the thing you are shopping for is an ingress, buy an ingress.
• You need to self-host. ReqKey is a managed service. If your compliance posture requires the key store inside your own VPC, Tyk or a self-hosted Unkey are better answers than we are.
• You want us to bill your customers. We meter usage and enforce quota. Turning that into an invoice is still your billing system's job.

2. Zuplo

An edge gateway you program in TypeScript, with API key management, a developer portal, and MCP and AI gateway features included on every plan. If you like the idea of policy as code reviewed through pull requests, it is the most pleasant thing in this category.

Pricing: Free is 100,000 requests/month with 1 day of analytics and 2 seats. Builder is $25/month including 100,000 requests, with additional requests at $100 per 100,000, and it is capped at 1,000,000 requests/month. Enterprise starts at $1,000/month on an annual contract, with 30-day retention.

Where it hurts: that overage rate works out to $1,000 per million, the steepest published per-request price in this set, and Builder's cap means you cannot simply grow into it. The step from Builder to Enterprise is roughly forty times the price with a sales call in the middle. If your traffic is anywhere near a million requests a month, price that jump before you integrate, not after.

3. Kong Konnect

The incumbent. Enormous plugin ecosystem, every protocol you have heard of, and the deepest enterprise story here. If you are already running Kong OSS, Konnect is the managed control plane for it and this is barely a migration at all.

Pricing: Plus is charged per gateway per month, not per workload: $25/month per serverless control plane (no SLA), $200/month per hybrid control plane (self-managed SLA), or $500/month per dedicated cloud gateway control plane plus $0.15 per GB of bandwidth, with a 99.99% SLA. Plus includes 1 million API requests/month, charges $200/month per additional million, and stops at a hard maximum of 10 million requests/month.

Where it hurts: that pricing shape is the hardest in this set to forecast, because your bill is a function of how many control planes you run rather than how much traffic you serve. And the $200-per-additional-million overage is ten times ReqKey's $25, so a Kong bill and a beside-path bill diverge sharply as you scale.

4. Tyk

The strongest genuinely open-source gateway on this list, with a dashboard in the OSS edition rather than the usual "the UI is the paid part" arrangement. If self-hosting is a hard requirement, start here.

Pricing: the open-source gateway is free. The commercial tiers publish no dollar figures at all. The pricing page describes Core as "Usage-based. Fully flexible," Professional as "One price. Unlimited access," and Enterprise as custom, with a contact form instead of a number.

Where it hurts: you cannot budget from a public page, which for a lot of small teams is itself the answer.

5. KrakenD and Gravitee

These are the two that the top-ranking "open source Unkey alternatives" page recommends alongside Tyk, so they deserve a straight answer rather than silence.

KrakenD is a stateless, config-driven gateway built for throughput, with a free community edition and an Enterprise tier that, like Tyk's, publishes no pricing. Gravitee is a full lifecycle platform (API gateway and observability, a developer portal, event and Kafka mediation, plus identity and access management) which today markets itself primarily as an AI agent management platform; it ships an open-source gateway and does not publish enterprise prices either. Both are legitimate, both are considerably more machinery than "verify this key and decrement a counter," and neither ships the consumer-level credit model that people usually mean when they say they want usage-based quota. Choose them because you want a gateway, not because a directory listed them under a keyword.

6. Roll your own

The option everyone considers and half the internet pretends is trivial. The core is genuinely small. Store a fast hash of the key with an indexed plaintext prefix so you can find the row without the secret, then count against Redis:

import hashlib, hmac, os

PEPPER = os.environ["API_KEY_PEPPER"].encode()

def fingerprint(key: str) -> str:
    return hmac.new(PEPPER, key.encode(), hashlib.sha256).hexdigest()

def verify(key: str):
    prefix = key[:10]                      # "acme_live_", stored in the clear and indexed
    row = db.fetchone(
        "SELECT id, key_hash, consumer_id FROM api_keys "
        "WHERE prefix = %s AND revoked_at IS NULL", (prefix,)
    )
    if row is None:
        return None
    if not hmac.compare_digest(row["key_hash"], fingerprint(key)):
        return None
    return row

That is maybe two days of work, and it is correct. Then the actual project starts: rotation without breaking live clients, revocation that propagates faster than your cache TTL, quota refill jobs that survive a downgrade mid-cycle, per-key analytics, and an admin UI so support does not page you to disable a key at midnight. Rolling your own key layer is a two-day project that ships in six weeks. Ask me how I know.

Build it anyway if key management is close to your product's core, or if your volume makes any per-request price absurd. We have written the two hardest parts up honestly: how to hash API keys and why you should rate limit by key rather than IP. Use them even if you never buy anything.

Not actually alternatives: Moesif and Treblle

Both turn up on these lists and neither can reject a request. Moesif does API analytics and monetization and now carries a site-wide banner stating it "has been acquired by WSO2 and will operate as an independent subsidiary," which is worth knowing before signing a multi-year contract. Treblle does API observability and quality scoring; its Core plan is $233/month billed yearly for 5 APIs, 500 requests/minute, 5 million requests/month and 30-day retention, with everything above that behind a demo booking.

They pair with a key layer. They do not replace one.

How to choose between these Unkey alternatives

Four questions, in this order:

Do you already run a gateway? If yes, do not add a second one. Anything in the in-front column is now a consolidation project, not a purchase, and a beside-path layer that plugs into the service you already have will ship this week instead of next quarter.

Is self-hosting a hard requirement, or a preference? If it is genuinely hard (regulated data, air-gapped environment), your list is Tyk, KrakenD, Gravitee, or Unkey under the AGPL, and you should confirm the contribution posture above is acceptable. If it is a preference, be honest that you are choosing to operate a stateful service on the hot path of every request you serve.

Do you need to limit how much, or how fast? These are different products dressed as one feature. Rate limits stop a client hammering you. Credits stop a client consuming more than they paid for, which is a billing question that happens to be enforced at auth time. Most tools here do the first well. Fewer do the second, and if you are selling metered API access you will need it. Ours lives in plans and credits, and the general design problem is covered in where the limit actually belongs.

What breaks when the auth service is unreachable? Ask this during evaluation, not during the incident. Every beside-path layer has a fail-open or fail-closed switch, and the answer determines whether an outage in your key vendor becomes an outage in your API or a window of unbilled traffic. Neither is free. Pick deliberately.

Key takeaways

• Sort candidates by position before you sort them by features. Beside-path, in-front, and after-the-fact tools have different install costs, different failure domains, and different bills. A feature grid that mixes them is comparing a library to a load balancer.
• Never compare price per request across billing units. A routed request, a valid request, a key validation and a logged event are four different things. Read what the vendor counts before you read what the vendor charges.
• Check the governance question, not just the license. Source-available under AGPL and open to your pull requests are separate properties. Unkey's README currently states it is not accepting external PRs, so if upstream influence was your reason for choosing open source, verify it rather than assuming it.
• Price the tier you will be on in a year, not the one you start on. Zuplo's Builder plan caps at 1M requests and Kong Konnect Plus at 10M, and both jumps land you in a sales conversation. Find the ceiling of every plan you are considering today.
• Decide the outage behaviour before you integrate. Fail open serves unverified traffic. Fail closed returns 503 to paying customers. There is no third option, and the default your vendor picked may not be the one you want.

If you land on the beside-path side of that decision, ReqKey's free tier is 100,000 requests a month with no card, which is enough to wire the middleware into a staging service, watch a consumer's credit balance actually move, and see what your 402 and 429 responses look like to a real client before you commit to anything. That is the part of an evaluation that tells you the most, and it is the part these comparison posts, including this one, cannot do for you. Start there.