Every roundup on this search is published by a company that sells a gateway, and each one ranks itself at or near the top — this page included, so treat the ordering below as what it is. The more useful correction is that those lists compare products that are not substitutes. "LLM gateway" names at least four different things: gateways that resell model access and hold the provider credentials for you, hosted control planes that route through accounts you hold yourself, proxies you deploy into your own infrastructure, and edge proxies that add caching and limits in front of your keys. A feature table that mixes them will point you at the wrong shape. Pick the category first; the choice inside a category is usually easy.
Bias declared: Kunavo is our product, and it competes in exactly one of the four categories below. For the other three we are not an option, and the page says so where that is the case.
The four categories
| Category | Who holds the provider account | Pick it when | Examples |
|---|---|---|---|
| Resold-access gateway | The gateway | You want one bill and no provider accounts at all | Kunavo, OpenRouter, AIMLAPI |
| Hosted control plane (BYO key) | You | You have accounts and want routing, governance, observability | Portkey, TrueFoundry, Helicone, Braintrust, orq.ai |
| Self-hosted proxy | You | Prompt text cannot leave your infrastructure | LiteLLM, MLflow AI Gateway |
| Edge proxy | You | You only want caching, rate limits and analytics | Cloudflare AI Gateway |
The dividing question is who holds the provider credentials. That single fact determines what you are billed for, who is liable when a key leaks, whether you can use negotiated provider rates, and how much of the system you operate. Everything else — routing policies, caching, dashboards — exists in every category and differentiates far less than the marketing suggests.
1. Resold-access gateways — no provider accounts
The gateway holds the upstream credentials and bills you for usage, so there is nothing to sign up for at Anthropic, Google or OpenAI. This is the category to want when the problem you are solving is procurement and setup rather than control: one key, one balance, one invoice.
Kunavo — one OpenAI-compatible base URL and one sk-kn- key across Claude, Gemini and GPT plus image, video and music models on the same balance, with most of the catalog listed under the providers' official rates. It does not route your own provider keys; if BYO-key is a requirement, this whole category is the wrong one. Pricing · Quickstart
OpenRouter — the breadth option: hundreds of models from a large provider set on one wallet, free tiers, and bring-your-own key routing that most of this category lacks. Pick it over Kunavo when catalog tail matters more than unit price. Kunavo vs OpenRouter · the full OpenRouter roundup
AIMLAPI — aggregates text and media models on one key, the same shape as the two above. Kunavo vs AIMLAPI
2. Hosted control planes — you keep the accounts
You hold the provider credentials; the platform adds routing, fallbacks, guardrails, spend governance and observability on top, and you do not run it. This is the category for teams with negotiated provider contracts, because those rates are worth more than anything a reseller can list. Kunavo is not an option here — we hold the upstream credentials by design, which is the opposite arrangement.
Portkey is the one we have evaluated (Kunavo vs Portkey); Helicone sits at the observability end of the same band (Kunavo vs Helicone). TrueFoundry, Braintrust and orq.ai occupy the enterprise end — SLAs, audit trails, evaluation tooling. We have not evaluated those three, so they are placed in the category and linked rather than ranked, and each of them ranks itself first on this search.
3. Self-hosted proxies — you run the software
An open-source proxy deployed into your own infrastructure, fronting your own provider keys. LiteLLM is the default choice and MLflow AI Gateway is the closest like-for-like. Pick this category when prompt text cannot leave your infrastructure — a constraint no hosted option in the other three categories can satisfy, at any price.
The cost is honest and worth stating: a self-hosted proxy is a package in your build, which puts your CI/CD and your cluster inside its blast radius. That is not hypothetical for this specific category — the March 2026 LiteLLM supply chain incident is the worked example, including what LiteLLM changed afterwards.
4. Edge proxies — caching and limits only
Cloudflare AI Gateway adds response caching, rate limiting, retries and analytics in front of provider accounts you already have, and resells no inference. It composes with any of the other three categories rather than replacing one — teams often run it in front of a resold-access gateway. Kunavo vs Cloudflare AI Gateway
How to choose in one pass
- Can prompt text leave your infrastructure? No → category 3, and stop reading. Yes → continue.
- Do you have negotiated provider rates or committed spend? Yes → category 2, so you keep using them. No → continue.
- Do you want to hold provider accounts at all? No → category 1. Yes → category 2.
- Do you need image, video or music on the same key? This narrows the field faster than any other criterion — check it before comparing anything else.
- Add category 4 on top of whatever you picked if caching or edge rate limits are a real requirement; it is not an alternative to the others.
What these lists all leave out
Two things, consistently. The first is what happens when the upstream provider fails: every gateway advertises failover, few publish what they actually do — the routing chain, the timeout, whether a failed request is billed. What a gateway should handle for you is the feature set worth interrogating, and the answer should be specific.
The second is migration cost. Every product in categories 1, 2 and 4 speaks the OpenAI wire protocol, so switching is a base_url and key swap — which means lock-in is low and the decision is far less consequential than a nine-item comparison table implies. The OpenAI-compatible API guide has the wire-level details.
FAQ
What is the best LLM gateway?
There is no single best one, because "LLM gateway" names four products that are not substitutes. If you do not want provider accounts at all, a resold-access gateway such as Kunavo or OpenRouter is the category. If you already hold provider accounts and want routing and governance over them, a hosted control plane such as Portkey or TrueFoundry is. If you want to run the software yourself, LiteLLM or MLflow AI Gateway. If you only want caching, rate limits and analytics in front of your own keys, Cloudflare AI Gateway. Pick the category before comparing feature tables.
What is an LLM gateway?
An LLM gateway is a single endpoint that sits between your application and one or more model providers, so your code targets one API and one key instead of one per provider. Beyond that shared definition the products diverge sharply: some resell model access and hold the provider credentials for you, others route requests through provider accounts you hold yourself, and others are libraries you deploy into your own infrastructure.
What is the difference between an LLM gateway and an LLM router?
In practice the terms are used interchangeably, and most products marketed as routers are gateways with routing features. Where a distinction is drawn, "router" emphasises choosing between models or providers per request — by cost, latency or availability — while "gateway" emphasises being the single entry point that also handles auth, spend limits, logging and failover. Buying decisions rarely turn on the label.
Do I need an LLM gateway if I only use one provider?
Usually not for routing, which is the feature that justifies most gateways. One provider and one key means there is nothing to route between. The reasons that still apply with a single provider are spend caps, request logging, key fan-out across a team, and failover to a second provider the day the first has an outage — and the last of those is an argument for having more than one provider, which brings routing back.
Is an open-source LLM gateway better than a hosted one?
They answer different constraints rather than ranking against each other. Open source and self-hosted means prompt text never leaves your infrastructure and you can read and patch the code, at the cost of running and patching a service — a self-hosted proxy is a package in your build, which puts your CI/CD and cluster in its blast radius. A hosted gateway removes that operational surface and adds a different exposure: your key and prompt text transit a third party. Regulated data usually settles it toward self-hosting.
Which LLM gateway is cheapest?
The cheapest arrangement depends on which half of the bill you are asking about. BYO-key tools (LiteLLM, Portkey, Helicone, Cloudflare) add little or nothing to inference cost, because you keep paying your own provider rates — the gateway charges for the control plane, not the tokens. Resold-access gateways set their own unit prices: Kunavo lists most models under the providers' official rates — Claude Sonnet 4.6 at $1.20 / $6.00 per 1M tokens against Anthropic's $3.00 / $15.00, though a few models, Claude Sonnet 5 among them, sit at list. If you have negotiated provider contracts, BYO-key almost always wins; if you are paying public list prices today, a reseller below list can be cheaper than your own account.
Which LLM gateways support image, video and audio models?
Coverage varies per vendor and changes often, so check the specific models you need against each catalog rather than trusting a category label. Kunavo carries image, video and music models on the same key and balance as chat, and OpenRouter's docs describe image, video and speech endpoints alongside chat. If multimodal on one key is a requirement, checking it first narrows the field faster than any other criterion.