Vercel AI Gateway vs Portkey

Most Vercel AI Gateway vs Portkey comparisons open with two feature grids and a checkmark count, and that framing hides the decision that actually matters. The two products answer different versions of the same question. AI Gateway is a routing layer built into the deployment platform. Portkey is a standalone operations layer that runs in front of model calls anywhere. The choice comes when an application deploys and a team must choose which operational layer they want to stop maintaining, not on which product lists more models.

Ownership is the other variable on the Portkey side. Palo Alto Networks completed its acquisition of Portkey on May 29, 2026, and Portkey now runs as the AI gateway layer inside the Prisma AIRS security platform. The rest of this guide works through where the two products diverge and which one fits a given stack.

Key takeaways:

• Vercel AI Gateway needs no configuration for teams already deploying on Vercel: OIDC authentication is automatic, and a plain model string like openai/gpt-5.6-sol routes through the gateway with no extra setup.

• Portkey covers ground AI Gateway does not, including 50+ guardrails, semantic caching, versioned prompt management, and self-hosting, which makes it the stronger pick when governance and compliance drive the call.

• The two products meter cost differently: AI Gateway passes through provider token rates at zero markup, while Portkey subscribes teams by recorded log volume and bills advanced features separately.

• Since the May 2026 acquisition by Palo Alto Networks, Portkey sits inside an enterprise security platform and is positioned as the gateway for Prisma AIRS, which is worth weighing for teams optimizing for developer velocity.

• Provider breadth rarely settles the decision, because most production teams still route to a single model provider, so deployment fit separates the two products more than model count does.

Copy link to headingVercel AI Gateway and Portkey solve different gateway problems

Vercel AI Gateway and Portkey are built to do different jobs, and the split starts with architecture. AI Gateway is a platform primitive. It runs on Fluid compute, the same runtime behind Vercel Functions, authenticates through OIDC tokens automatically, and reports observability in the same dashboard as the frontend. Portkey is a standalone operations layer that sits in front of model calls no matter where the application runs. Both approaches are valid, and each fits a different kind of team.

Copy link to headingWhat this comparison is based on

This comparison draws on each vendor's public documentation and changelogs, plus Vercel's own published data on AI Gateway in production. Vendor docs describe intended behavior, so the weighting here favors the operational dimensions that compound over a project's life, including deployment coupling, governance depth, reliability under real traffic, and how pricing scales once request volume is real.

One industry pattern frames the whole comparison. Portkey's production data shows multi-provider adoption climbing from 23% to 40% over roughly ten months, so most production teams still standardize on a single provider. Model count reads as a headline feature, though for most teams it works out to a tiebreaker.

The dimensions that do decide the call fall into five buckets. The table below lays them out, and the sections after it walk through each one.

Read each row as a real operational tradeoff:

Copy link to headingZero-config authentication assumes a Vercel deployment

AI Gateway's zero-configuration story holds only for applications already on Vercel. OIDC handles authentication automatically, the gateway injects provider credentials, and application code never touches an underlying provider key. Portkey reaches the same models through a base URL and an x-portkey-api-key header, which works in any environment but is a configuration step rather than an absence of one.

Copy link to headingGuardrails and prompt governance are Portkey-only

AI Gateway forwards prompts to providers without gateway-level scanning or redaction, so it ships no guardrails today. Portkey runs guardrails as before-request and after-request hooks with actions such as deny, log, fallback, or retry, and it adds versioned prompt templates with role-based access control. For an application handling user input or returning regulated content, that gap is the single clearest reason to pick Portkey.

Copy link to headingReliability routing has documented outcomes on Vercel

Both products offer automatic failover and multi-provider routing, and the practical question is what that buys under real traffic. AI Gateway carries public production evidence from live A/B tests on customer workloads, quantified later in this guide. Portkey publishes routing and reliability features without an equivalent public A/B result to point to.

Copy link to headingThe two products meter cost differently

AI Gateway charges provider list rates with zero markup, and certain advanced features are metered separately on paid tiers. Portkey subscribes teams by recorded log volume, starting free at 10,000 logs and moving to $49 per month for 100,000 logs. The meters reward opposite usage shapes, so the cheaper product depends on request volume and how much per-request logging a team keeps.

Copy link to headingSelf-hosting exists only on Portkey

AI Gateway runs as a Vercel platform product with no self-hosted deployment. Portkey offers managed cloud, a hybrid mode with the gateway in a team's own VPC, and a fully airgapped option, and its infrastructure repository ships Terraform and CloudFormation templates. When data-residency rules require the gateway inside a network boundary, Portkey is the only option here, though its open-source Gateway 2.0 remains pre-release.

Copy link to headingVercel AI Gateway is a platform-native gateway

Vercel AI Gateway is a unified API for routing LLM requests across hundreds of models from providers including OpenAI, Anthropic, and xAI. It launched in alpha in May 2025 and is now generally available with automatic failover, built-in observability, and Bring Your Own Key support at no markup.

What sets it apart is its place in the deployment platform rather than any single feature. For a Vercel-hosted app, an AI SDK model string in provider/model-id format routes automatically through the gateway over an OIDC token, so application code holds no keys and the team operates no separate proxy.

The product surface is what teams work with day-to-day, and the tradeoffs read more clearly once it is laid out.

Vercel AI Gateway pros:

• Zero-config authentication: OIDC removes provider-key management for Vercel-hosted apps, and the gateway injects credentials so secrets never reach application code.

• Pass-through pricing: Token costs bill at provider list rates with no markup, including on Bring Your Own Key requests, so there is no platform fee layered on inference.

• Efficient compute model: Running on Fluid compute with Active CPU pricing means the gateway bills CPU rates only for the milliseconds that do work, not for time spent waiting on a provider.

• Documented reliability routing: Automatic failover and latency-aware routing have measured production outcomes behind them.

Vercel AI Gateway cons:

• No guardrails: Prompts pass to providers without gateway-level content filtering, PII redaction, or injection checks, so content safety lands in the application layer.

• No managed cache: The gateway surfaces provider-side prompt caching metrics but does not run a cache of its own, so semantic caching is out of scope.

• No self-hosting: It runs only as a Vercel platform product, which rules out network-boundary or airgapped deployments.

Best for: Teams whose applications run on Vercel and whose priority is reliability routing, spend visibility, and no separate service to operate. The payoff is largest when the team already builds with the AI SDK and wants model routing to be the default behavior of a plain string.

Pricing: Usage bills as pay-as-you-go credits at provider list rates with no markup. Some advanced capabilities, such as custom reporting and team-wide controls like Zero Data Retention or provider allowlists, carry additional usage-based charges on paid tiers.

Copy link to headingWhere Vercel AI Gateway stands out

The gateway pulls ahead on reliability outcomes measured in production. In a one-week live A/B test, Cline saw API error rates fall 43.8% and P99 streaming latency improve 10 to 14% across its most-used models, all routed through Vercel's global network.

Those gains land hardest on interactive workloads, where the slowest 1% of requests is exactly where users feel a stalled agent. Routing with sub-20ms overhead keeps that long tail short without the team owning the routing logic.

Copy link to headingPortkey is a standalone AI gateway and operations layer

Portkey is a universal API layer for 1,600+ LLMs and a proxy that sits in front of model provider calls. It combines routing, observability, guardrails, caching, and prompt management in one managed product, and nothing couples it to a specific cloud.

Its reach now extends past routing into governance. Since the May 2026 acquisition, Portkey belongs to Palo Alto Networks and is positioned as the AI gateway inside Prisma AIRS, which reframes the evaluation question from "is this a capable gateway" to "is this a capable gateway, and where does it head under a security vendor."

The product surface is broader than a router's, and the tradeoffs follow from that breadth.

Portkey pros:

• Guardrails framework: 50+ checks cover prompt injection protection, PII redaction, and harmful-content filtering, plus partner integrations such as CrowdStrike AIDR and Lasso Security, running as before-request and after-request hooks.

• Semantic caching: The cache returns prior responses for semantically equivalent queries as well as exact-match prompts, which cuts repeat-query cost.

• Versioned prompt management: Prompt templates ship with role-based access control and instant rollback, so prompt changes are independent of application deploys.

• Deployment flexibility: Managed cloud, hybrid VPC, and airgapped options run the same gateway, and an MCP Gateway routes tool calls through the same governance layer as model requests.

Portkey cons:

• Log-volume pricing: Because the meter is recorded logs, full per-request logging at high volume can cost more than the entry tiers suggest.

• No native zero-config on Vercel: Reaching the gateway takes a base URL swap and a header rather than automatic authentication for a Vercel-hosted app.

• Roadmap under new ownership: The Prisma AIRS direction points toward enterprise security tooling, which teams choosing Portkey for developer velocity should track.

Best for: Teams that deploy across multiple environments or outside Vercel, handle regulated content, or need guardrails, semantic caching, versioned prompt management, or a self-hosted deployment inside their own network boundary.

Pricing: A free Developer tier covers 10,000 recorded logs per month with 3-day log retention. The Production tier runs $49 per month for 100,000 logs with $9 per additional 100,000 requests, and a custom Enterprise tier adds SSO, VPC hosting, HIPAA, and SOC 2 coverage, and role-based access control.

Copy link to headingWhere Portkey stands out

Portkey pulls ahead wherever governance sits in the request path. Output guardrails for streaming responses, added in April 2026, run after the assistant message finishes, so a team can filter model output as well as the incoming prompt. That before-and-after coverage is the kind of control a compliance review asks for.

The self-hosting options extend the same advantage. Running the gateway inside a VPC or an airgapped network keeps prompts and responses within a boundary the team controls, which is often a hard requirement in regulated industries.

Copy link to headingVercel AI Gateway vs Portkey comes down to deployment fit

Feature-grid length rarely settles Vercel AI Gateway vs Portkey. What decides it is where the application deploys and which operational layer the team wants to stop maintaining. The teams that regret a gateway choice usually optimized for the wrong one, picking on model count or a single feature and inheriting a coupling or a cost curve they had not modeled.

Copy link to headingChoose Vercel AI Gateway when you deploy on Vercel

AI Gateway is the stronger call for an application already running on Vercel that wants gateway behavior without a separate service. The fit is cleanest when these hold:

• You build with the AI SDK: Model routing becomes the default behavior of a plain string rather than a configured integration.

• You want pass-through pricing: Token costs stay at provider list rates with no platform subscription layered on top.

• Reliability and cost visibility lead: The priority is failover, routing, and per-request spend data, with content safety handled in the application layer.

• One dashboard is enough: Request-level cost and latency alongside the frontend covers the observability need.

For teams matching that shape, the gateway removes a configuration surface and an operational dependency.

Copy link to headingChoose Portkey when governance or self-hosting leads

Portkey is the stronger call when governance depth or deployment independence outranks platform-native convenience. It fits when these hold:

• You deploy outside Vercel: The gateway runs across multiple environments without coupling to one host.

• Guardrails are a requirement: Content filtering, PII redaction, or injection checks need to run before requests reach a provider.

• Procurement demands compliance features: Audit logs, HIPAA coverage, SSO, and RBAC are hard requirements.

• Self-hosting is mandatory: Data-residency rules require the gateway inside a network boundary.

For those teams, Portkey trades platform-native simplicity for governance depth and deployment flexibility, which is the right trade when compliance drives the decision.

Copy link to headingHow Vercel AI Gateway routes, secures, and scales LLM traffic

Teams building LLM features on Vercel hit a recurring set of operational problems well before model choice matters. Each has a direct answer in the platform, and the answers lead with what the gateway does that a bolt-on layer cannot.

Copy link to headingOne gateway config replaces eight provider SDKs

The friction starts with provider sprawl. Every new model provider means another SDK, another set of keys, and another dashboard, and each addition pulls an engineer off product work to write an adapter. Okara, whose AI CMO now serves 120,000 websites, ran into exactly this across eight providers before moving to AI Gateway. A single gateway configuration replaced those integrations, and the day a new model ships, the team can route to it without an adapter or a deploy cycle.

Copy link to headingAutomatic failover keeps retry logic out of your code

The next problem surfaces under real traffic, when hand-maintained retry and fallback logic becomes its own maintenance burden and a source of outages. AI Gateway moves retries and provider routing into the platform, so that logic leaves the application codebase. The measured result for Zo Computer was a retry rate falling from 7.5% to 0.34% and average attempts per chat reaching 1.00, a 20x reliability improvement that meant nearly every request succeeded on the first try.

Copy link to headingActive CPU pricing bills only the work that runs

Gateway workloads are network-bound, and that reshapes the cost model. Routing plus credential and quota checks take milliseconds, while waiting for a provider to stream a response takes seconds. In AI Gateway's first month, it handled roughly 16,000 total runtime hours, of which only 1,200 involved actual CPU work. Because Fluid compute bills CPU rates only while code runs, the gateway pays CPU rates for under 8% of that runtime instead of all of it.

Copy link to headingOIDC authentication removes provider keys from your app

Key management is the failure mode that spreads quietly, as provider secrets accumulate across environments and rotation turns into a standing chore. On Vercel, OIDC authenticates the app to the gateway automatically, and the gateway injects provider credentials so application code never holds a key. A model call becomes a plain string.

Pass a model slug straight to the AI SDK and the request routes through the gateway with no key handling:

import { generateText } from 'ai';

const { text } = await generateText({
  model: 'openai/gpt-5.6-sol',
  prompt: 'Summarize the incident report.',
});

From there, budgets enforce spend limits and return an HTTP 402 on overage, and Zero Data Retention and provider allowlists apply per request or team-wide, all without a second service to run.

Copy link to headingShip reliable multi-provider AI on Vercel

The Vercel AI Gateway vs Portkey decision reduces to which cost a team would rather carry, either the configuration surface of a standalone operations layer or the platform coupling of a gateway built into the deploy target. For a team already on Vercel, the platform-native path removes the provider sprawl, retry logic, and key management that otherwise sit in the application codebase, and it does so on the same runtime and dashboard as the rest of the stack.

For AI applications on Vercel, that collapses onto a small set of primitives:

• Fluid compute with Active CPU pricing: Concurrent, I/O-bound gateway traffic bills CPU rates only for the work that runs, not for time spent waiting on a provider.

• AI Gateway routing and failover: One integration reaches hundreds of models with automatic failover and Bring Your Own Key at no markup.

• OIDC authentication: Vercel-hosted apps authenticate to the gateway automatically, so provider keys never reach application code.

• Spend and safety controls: Budgets, Zero Data Retention, and provider allowlists enforce limits per request or across a team without code changes.

• AI SDK model routing: A plain provider/model-id string routes through the gateway, so switching models is a one-line change.

Start a new project and wire in a model string, or browse the templates to build from a working setup.

Copy link to headingFrequently asked questions about Vercel AI Gateway vs Portkey

Copy link to headingCan I use Vercel AI Gateway outside Vercel hosting?

Yes. Vercel-hosted apps authenticate with OIDC tokens automatically, and applications hosted elsewhere authenticate with a AI_GATEWAY_API_KEY. There is no self-hosted AI Gateway deployment, so a network-boundary requirement points to Portkey or another standalone gateway.

Copy link to headingDoes Vercel AI Gateway add latency to my LLM requests?

Routing overhead is sub-20ms, since the request routes through Vercel's global network before reaching the provider, a figure the Cline A/B test confirmed in production. No independent third-party benchmark exists for either product, so latency-sensitive teams should test against their own workloads.

Copy link to headingDoes Portkey's Palo Alto Networks acquisition change pricing or API behavior?

No public change to pricing or API behavior has been announced. The acquisition completed on May 29, 2026, with Portkey positioned as the gateway for Prisma AIRS. Future roadmap and pricing are not publicly documented, so confirm current terms with Portkey before committing.

Copy link to headingWhat does Portkey cost in production versus the free tier?

The free Developer tier covers 10,000 recorded logs per month with 3-day retention, and the Production tier is $49 per month for 100,000 logs plus $9 per additional 100,000. Log volume grows fast with full observability on, so price it at real request volume.

Copy link to headingHow do I handle content safety for Vercel-hosted apps?

AI Gateway offers no gateway-level guardrails today, so content safety runs in the application layer through provider-native filtering or a separate evaluation step around AI SDK calls. This is an acknowledged gap relative to Portkey, and a hard guardrail requirement factors directly into the choice.