Cloudflare AI Gateway Alternatives 7 Options Compared

List provider endpoints, headers, retry rules, cache keys, rate limits, log fields, budget rules, and fallback order. A one-line endpoint swap can hide many policy differences.

Replay representative streaming, tool-use, image, structured-output, timeout, and provider-error cases. Compare status codes and response shapes, not only successful text output.

Mirror a small percentage of non-sensitive requests to the new path, compare latency and output metadata, then increase traffic gradually with a documented rollback trigger.

Keep provider routing in the gateway. Route live financial data, tools, and external actions through a capability layer with its own discovery and audit controls.

Cloudflare remains compelling when Workers, edge caching, and existing Cloudflare policy are central to the application.

LiteLLM, Envoy, or Kong becomes more attractive when the infrastructure team must control deployment, networking, data paths, and upgrades.

OpenRouter reduces integration work when breadth of models and provider fallback matter more than owning gateway infrastructure.

A gateway controls model traffic. Add QVeris when agents must discover and call live datasets, financial APIs, or external tools with auditability.

A vendor grid is useful only after the team defines deployment, privacy, observability, routing, and ownership requirements.

Compatible request shapes do not guarantee identical streaming events, tool schemas, errors, retries, or provider-specific parameters.

Preserve project, customer, environment, and model tags so the new gateway can explain spend from day one.

Model routing and real-world capability access are separate architecture layers with different reliability and audit needs.

Prioritize Portkey when the product team wants routing, guardrails, observability, and policy workflows without owning every backing service. Validate log retention, redaction, regional requirements, and the exact plan needed for production controls before committing.

Prioritize LiteLLM, Envoy AI Gateway, or Kong when deployment, networking, data paths, upgrades, and incident response must remain under internal control. The deciding factor is often the platform team's existing Kubernetes, proxy, database, and observability maturity.

Prioritize OpenRouter when fast access to a broad catalog and managed provider routing matter more than infrastructure ownership. Review provider-selection policy, privacy controls, fees, budgets, version pinning, and how the application behaves when the preferred route is unavailable.

Keep a model gateway for inference and add QVeris for capability discovery, inspection, and calls. This is an architecture composition rather than a replacement decision: the gateway controls model traffic while the capability layer controls external data and actions.

Ask where prompts, responses, metadata, cache entries, logs, traces, and evaluation datasets are processed and stored. Include the underlying model provider, not only the gateway vendor, and document every retention period and regional transfer.

Test how the product separates organizations, projects, customers, environments, and human operators. Confirm key rotation, revocation, least-privilege roles, service accounts, audit logs, and whether a compromised project key can cross a tenant boundary.

Compare support response, uptime commitments, breach notification, subprocessor disclosure, data-processing terms, export rights, termination assistance, and enterprise minimums. A technically cheaper gateway can become expensive when legal or support requirements appear late.

Before signing, export representative logs and configuration, rotate credentials, and move one route to a direct provider or another gateway. Record the time, missing metadata, application changes, and vendor assistance required to complete the exercise.

Capture a privacy-safe sample of streaming, structured output, tool calls, long context, and failure cases. Replay it through each candidate so the decision reflects your workload rather than a vendor feature matrix.

Inventory Workers bindings, analytics exports, cache behavior, authentication, and network policy tied to Cloudflare. Separate portable gateway logic from edge-specific conveniences before estimating migration effort.

Test timeout, 429, provider 5xx, broken streaming, and exhausted-budget behavior. Record retry ownership, fallback order, error normalization, alert timing, and what users see when every route fails.

Keep aliases, keys, configs, logs, and dashboards exportable. A migration is ready only when the team can shift a small traffic slice, compare outcomes, and return to the previous route without losing traceability.