Kong Pricing: The Real Cost of "Open Source" & Enterprise Alternatives

Kong pricing is straightforward on the surface and complicated in practice. Here is what every tier actually costs.

Kong Gateway runs across three pricing models. Kong OSS is free to download and self-host. Kong Konnect Plus charges per gateway per month, with 1 million API requests included and $200 for every additional million (capped at 10 million per month on Plus). Kong Konnect Enterprise is a custom annual contract with no published rate, starting around $30,000 to $50,000 annually for smaller deployments and scaling into six figures for larger organisations.

The gap between what those headline numbers say and what teams actually spend is where this guide is useful.

‍TL;DR

Kong OSS is free to download but carries significant operational cost: no GUI, no analytics, no RBAC, and no advanced security plugins without building them yourself.

Kong Konnect Plus is a per-gateway subscription plus per-request overages. A programme handling 50 million calls per month can trigger close to $10,000 in traffic charges alone.

SSO, Audit Logs, and advanced governance are Enterprise-only. Many teams upgrade for these features before their API volume justifies the contract.

Kong's developer portal charges $200 per month per portal on Plus, with a 20-API cap per portal. Both limits compound as programmes scale.

DigitalAPI sits above Kong OSS or Kong Konnect as a gateway-agnostic control plane, adding portal, partner onboarding, credential lifecycle, and MCP readiness on a flat subscription with no per-request variable.

Already on Kong and spending more than expected? See how DigitalAPI adds the programme layer above Kong without replacing your gateway runtime.

The Three Kong Pricing Tiers

Kong's pricing splits cleanly into three models. The cost structure, feature access, and operational overhead are different enough between them that teams should evaluate each one against their actual programme requirements, not just the entry price.

Kong Gateway OSS: free to download, expensive to operate

Kong OSS is available on GitHub at no licence cost. It handles the data plane: routing, rate limiting, plugin execution. What it does not include is everything a team needs to manage that gateway at scale.

There is no admin GUI. Configuration runs through the CLI, YAML files, or the Admin API. That is manageable at five APIs. It becomes a coordination problem at fifty and a full-time job at five hundred. There is no central dashboard for traffic patterns, error rates, or consumer usage. No analytics. No RBAC. The security plugins teams typically need in production, including OpenID Connect, Kafka event streaming, SOAP to REST transformation, and canary release management, are not available in OSS.

The operational cost is not the licence. It is the engineering hours spent building the management layer Kong OSS does not include.

‍

Teams that start on Kong OSS and need any of these features eventually face the same conversation: buy Konnect, build it yourself, or find a control plane that works above the existing OSS instance.

Kong Konnect Plus: the hybrid cost model

Konnect Plus is Kong's SaaS management layer. Kong hosts the control plane. Teams run the data plane in their own infrastructure. The billing model combines a base subscription with usage-based charges, which is where most cost surprises come from.

The per-request overage is the charge that most teams fail to model correctly at the evaluation stage. A programme that looks affordable at 5 million calls per month can look very different at 30 million. The 10 million monthly cap on Plus means any programme approaching that volume is effectively forced into an Enterprise conversation regardless of feature requirements.

Kong Konnect Enterprise: custom contract, no published rate

Enterprise is Kong's contract tier. There is no public pricing. Contracts are negotiated based on gateway count, traffic volume, feature requirements, and support tier. Based on industry reporting, Enterprise starts in the $30,000 to $50,000 range annually for smaller deployments. Large organisations with multi-region setups, high API volumes, and premium support have reported contracts well into six figures.

Enterprise removes most of the Plus-tier limits: unlimited gateways, unlimited developer portals, unlimited published APIs, customisable analytics. It also adds SSO, Audit Logs, advanced governance, and a range of support tiers from Business (regional hours, 2-hour SLA) to Diamond (24/7, 30-minute SLA).

One structural point worth noting: many teams upgrade from Plus to Enterprise primarily to get SSO and Audit Logs, not because their API volume requires it. Those two features being Enterprise-only is a forcing function that pushes teams to contract tiers faster than their actual usage would suggest.

The Additional Costs That Surface After the Contract

The licence is only part of what Kong costs in practice. Once teams are running Konnect in production, several additional cost drivers appear that are not visible during the initial evaluation.

Plugin access and enterprise feature gates

Kong's plugin system is one of its core strengths. The gap between what is available in OSS and what requires Enterprise licensing is significant for teams with standard enterprise security and integration requirements.

‍

Teams that design their architecture around Kong OSS and then discover they need OIDC face a choice: build a custom plugin in Lua, or upgrade to Enterprise. The custom plugin route requires engineers who understand Kong's Lua extension model. That is a specific hiring requirement.

Lua and the skill gap cost

Kong is built on NGINX and extended using Lua. Troubleshooting production incidents often requires Linux and NGINX expertise at a level that is not common in most platform engineering teams. Custom plugin development in Lua or Go adds a further hiring constraint. The total cost of ownership includes the engineering hours required to maintain the gateway stack, and those hours are more expensive than the licence at most organisations running Kong at scale.

Analytics and observability overhead

Kong OSS has no native analytics. Teams running OSS build their own observability stack, typically using Prometheus, Grafana, and ELK. That infrastructure carries its own compute, storage, and maintenance cost. Konnect Plus includes analytics, but with request volume caps. Enterprise unlocks customisable analytics.

For teams that need cross-gateway visibility, spanning Kong and other gateways in the estate, neither Konnect tier includes a cross-gateway analytics layer. That requires either a separate tool or a control plane that federates multiple gateways.

Kong Konnect vs The Market

Kong vs AWS API Gateway

AWS API Gateway runs on a strict pay-per-request model. At $3.50 per million requests, 50 million calls costs approximately $175 per month with no fixed base. That model works well for programmes with unpredictable or low-volume traffic, where paying nothing when traffic stops is a genuine advantage.

Kong Konnect Plus combines a fixed base with per-request overages. The fixed base provides predictability at the low end. The overage structure means that high-volume programmes pay more per request at scale than AWS's pure consumption model, and once the Plus tier's 10 million monthly cap is reached, the only option is an Enterprise contract.

The two models solve different problems. AWS API Gateway is appropriate for teams already embedded in the AWS ecosystem with serverless backends and variable traffic. Kong Konnect is appropriate for teams that need a gateway runtime they can deploy across multiple clouds with a large plugin ecosystem.

Kong vs Gravitee

Gravitee handles event-driven and async APIs at the core of its architecture. Kafka ingestion, MQTT, WebSocket, and REST all sit in the same gateway without requiring enterprise add-ons. Teams building programmes that need to bridge REST and event-driven APIs find Gravitee's cost model more predictable because the protocol capabilities are bundled rather than gated behind enterprise plugins.

Kong handles REST traffic extremely well. The async and event-driven capabilities require Enterprise licensing, which adds cost for any team that needs both REST and event protocol support.

‍

Kong vs DigitalAPI: the control plane approach

The comparison between Kong and DigitalAPI is not a gateway vs gateway comparison. DigitalAPI is not a gateway replacement. It is a control plane that sits above Kong OSS or Kong Konnect and adds the programme layer that Kong does not provide natively: unified catalogue, self-serve developer portal, credential lifecycle, partner onboarding, cross-gateway analytics, and MCP readiness.

Teams running Kong OSS can pair it with DigitalAPI and get the governance, portal, and analytics capabilities that would otherwise require a Konnect Enterprise contract, without paying Kong's per-request pricing or being constrained by the Plus tier's portal and API limits.

‍

DigitalAPI connects to Kong OSS instances via the Kong Admin API, pushing configurations, managing consumers, and enforcing API governance policies above the existing data plane. The Kong runtime continues handling all traffic. The DigitalAPI control plane adds the management, portal, and programme layer above it.

For teams evaluating the jump from Kong OSS to Kong Konnect Enterprise, adding DigitalAPI above Kong OSS often produces the same capability set at a lower total cost because there are no per-request overages, no per-portal charges, and no feature gates that require contract upgrades.

If you are running Kong alongside other gateways including Apigee, AWS API Gateway, or Azure APIM, DigitalAPI's API gateway manager federates all of them into one catalogue. Kong Konnect's Service Catalog covers Kong APIs only.

Frequently Asked Questions

1. Is Kong Konnect expensive?

‍Kong Konnect becomes expensive when API request volumes exceed the 1 million monthly inclusion on Plus.
The per-request overage at $200 per million scales linearly. A programme handling 10 million requests per month on Plus pays $200 in base fees plus $1,800 in overages, totalling $2,000 before portal or analytics charges. High-volume programmes hit the 10 million monthly cap on Plus and are directed to Enterprise pricing discussions.

2. Can I use Kong OSS in production?

‍Yes. Kong OSS is production-ready and handles high-volume API traffic reliably at scale.
It lacks a native GUI, analytics, advanced security plugins including OIDC, and RBAC. Running it in production requires engineering investment to build monitoring dashboards, manage configuration through the CLI or Admin API, and handle authentication flows that OSS does not support natively. Teams that need these capabilities either build them or move to a paid tier.

3. What does Kong Enterprise cost?

‍Kong Enterprise does not have a published price. Contracts are negotiated directly with Kong's sales team.
Based on industry reporting, Enterprise contracts start in the $30,000 to $50,000 range annually for smaller deployments. Larger organisations with multi-region deployments, high API volumes, advanced analytics requirements, and Diamond-tier support report contracts well into six figures. Kong also includes annual price escalators of 5 to 10 percent in standard renewal terms.

4. How does DigitalAPI work with Kong OSS to reduce costs?

‍DigitalAPI connects above Kong OSS via the Admin API and adds governance, portal, and analytics without a Konnect licence.
The Kong OSS instance continues handling all runtime traffic. DigitalAPI provides the control plane: dashboard, RBAC, SSO, API governance, self-serve developer portal, credential lifecycle, partner onboarding, API monetization, and MCP readiness. Teams get the capabilities that would otherwise require a Kong Konnect Enterprise contract on a flat DigitalAPI subscription with no per-request variable.

5. Does DigitalAPI support other gateways besides Kong?

‍Yes. DigitalAPI is gateway-agnostic and connects to Apigee, AWS API Gateway, Azure APIM, Gravitee, Tyk, Zuplo, and API7 simultaneously.
This means teams running Kong alongside other gateways get one portal, one catalogue, one credential lifecycle, and one partner onboarding workflow across the entire estate. Kong Konnect's Service Catalog covers Kong-managed APIs only. DigitalAPI's API discovery layer federates every connected gateway into one searchable catalogue.

6. What is the difference between Kong Gateway OSS and Kong Konnect?

‍Kong Gateway OSS is the self-hosted data plane. Kong Konnect is the SaaS-hosted control plane that sits above it.
OSS handles routing, rate limiting, and plugin execution at no licence cost. Konnect adds the management UI, analytics, developer portal, and enterprise features like SSO and Audit Logs. The two can run together: OSS as the data plane in your infrastructure, Konnect as the management layer hosted by Kong. Konnect pricing is separate from the OSS licence and adds the per-request and per-feature charges described above.

7. What AI and MCP features does DigitalAPI add to Kong OSS?

‍DigitalAPI adds a native MCP layer that converts any Kong-managed API into an MCP tool for LLM and agent consumption.
MCP tools carry scoped credentials, rate limits, and audit trails. This capability is available for APIs managed by Kong OSS or any other connected gateway, without requiring Kong's AI Gateway add-on or Enterprise licensing. The MCP conversion runs through MCP Studio in seconds.

8. How does Kong's developer portal pricing work on Konnect Plus?

‍Kong Konnect Plus includes up to 2 developer portals at no extra cost, with a hard cap of 20 published APIs per portal.
Additional portals cost $200 per month each. The first 10 published APIs within a portal cost $20 per month each. Additional APIs beyond 10 cost $10 per month each, up to the 20-API maximum. Teams with large API catalogues or multi-brand programmes hit these limits quickly. Kong Konnect Enterprise removes all portal and published API limits.