The best way to ask for advice here is to *not* ask for the "best" tool. That just gets you a list of vendor marketing copy and hype. You'll end up with a bloated SaaS contract and a false sense of security.
Instead, tell us:
* What you're actually trying to do, with a concrete example.
* Your non-negotiables (budget, must be self-hosted, etc.).
* What you've already tried and *why* it failed.
I'll probably suggest an open-source alternative the big names hate. I work in fintech infra, so I've seen every shiny platform turn into a compliance nightmare. Looking for posts that dig into real security flaws and support horror stories, not just feature checklists.
—aB
—aB
I'm a principal cloud architect at a mid-size payment processor, and we run over 300 nodes across hybrid Kubernetes clusters, where we've had to deploy, migrate, and ultimately replace several of the major API gateway and service mesh solutions.
**1. Target fit and complexity**
Kong is aimed at mid-market to large enterprises ready for a dedicated platform team; its declarative config and full lifecycle management assume you have 1-2 FTE to manage it. Tyk is a better fit for SMBs or platform teams under 10 engineers who need a working API gateway out of the box without deep Kong Lua or Go plugin development.
**2. Real pricing and hidden costs**
Kong Enterprise list price starts around $50k/year but true cost is 2-3x that after required support and scaling nodes; you pay per data plane node. Tyk's cloud tier is $600/month for 50k requests/minute, but on-premises pricing is opaque and scales with core count. The hidden cost for both is developer time writing custom plugins or policies, which for Kong can be 20-30% of initial project time.
**3. Deployment and operational effort**
A full Kong deployment (control plane, data planes, PostgreSQL) takes a senior engineer 2-3 weeks to stabilize in production, mostly due to tuning DB connections and hybrid cloud networking. Tyk can be containerized and routing in a day, but multi-dc replication needs another week. Kong's declarative configuration requires a strict GitOps pipeline; without it, config drift causes outages.
**4. Where it breaks or the honest limitation**
Kong's performance degrades noticeably after 150-200 active plugins per node; we saw latency jump from 8ms to 22ms p95. Tyk's Redis dependency becomes a single point of failure under high load; we had to shard after hitting ~2.5k req/s per gateway node. Kong's documentation for advanced hybrid deployments is incomplete, and Tyk's enterprise support response time exceeded 4 hours during a P1 incident.
I would recommend Tyk for a team that needs a functional API gateway within a week and has fewer than 20 microservices. For a large, complex deployment needing deep customizability and a mature plugin ecosystem, Kong is the choice. Tell us your team's size and whether you need rate limiting based on IP or user identity.
Mike
Great point about hidden costs extending beyond the price tag. You mentioned developer time for custom plugins, and that's so true - I've seen teams underestimate the ongoing maintenance of those plugins, especially when Kong does a major version upgrade and breaks compatibility.
One nuance: the 20-30% project time for Kong custom work can balloon if you don't have in-house Lua expertise. It sometimes forces a hire, which is another hidden cost aB's original advice was getting at.
Thanks for sharing your real world numbers on deployment time too. That's gold for anyone budgeting.