Last updated October 14, 2026. Pricing, ownership, routing, and BYOK claims were checked against each vendor’s primary docs and pricing pages on that date.
Portkey vs LiteLLM vs OpenRouter is the three-way shortlist most platform teams reach once they decide an LLM gateway must sit between apps and model providers. All three centralize credentials and routing. They diverge on ops model, fee shape, and how much of the control plane you run yourself.
This post is the deep comparison for stacks choosing among a managed control plane (Portkey), a self-host open-source proxy (LiteLLM), and a multi-model catalog with one bill (OpenRouter). Placement is unpaid, per our editorial standards and disclosure policy.
It sits under the AgentOps tools map and the AI Gateways category, next to our observability tools roundup and open source LLM observability shortlist. We compare pricing shapes, virtual keys and budgets, routing and fallbacks, observability hooks, self-host versus SaaS, BYOK, provider coverage, and when each wins.
TL;DR
- Portkey wins as a managed control plane: Developer free for 10k recorded logs/mo; Production $49/mo for 100k logs; Enterprise custom. MIT-shaped self-host gateway available, with Palo Alto Networks ownership via Prisma AIRS AI Gateway (GA July 2026).
- LiteLLM wins as the self-host default: MIT OSS free forever with virtual keys, budgets, and fallbacks; Enterprise priced by annual gateway request capacity, never per token.
- OpenRouter wins for catalog breadth with zero gateway ops: provider inference prices pass through; 5.5% fee on credit purchases ($0.80 min); BYOK free to $25k/mo list-price inference on PAYG.
- Fee filter: model tokens and gateway fees are separate lines. Portkey meters recorded logs. LiteLLM OSS is $0 license. OpenRouter fees sit on credits and over-allowance BYOK.
- Ops filter: no gateway SRE? Prefer Portkey or OpenRouter. Need VPC/air-gap and your own keys? Prefer LiteLLM (or Portkey OSS).
- Ownership note: Palo Alto closed the Portkey acquisition on May 29, 2026; Prisma AIRS AI Gateway GA was announced July 16, 2026. Re-check packaging before multi-year commits.
Portkey vs LiteLLM vs OpenRouter: The Short Answer
Pick Portkey when you want managed virtual keys, guardrails, prompt management, and log-metered SaaS without staffing a proxy rotation. Pick LiteLLM when you will run the gateway in your VPC and want MIT virtual keys, budgets, and wide provider coverage on day one. Pick OpenRouter when time-to-many-models and one aggregated bill matter more than self-hosting the control plane.
| Portkey | LiteLLM | OpenRouter | |
|---|---|---|---|
| Center of gravity | Managed AI gateway + observability + guardrails | Self-host OpenAI-compatible proxy + governance | Unified catalog API across many providers |
| Self-host control plane | Yes (Host it Yourself / OSS gateway) | Yes (MIT core; Enterprise license key) | No |
| Entry gateway price | Dev free (10k logs); Production $49/mo | $0 OSS; Enterprise by capacity | 5.5% on credit buys ($0.80 min) |
| Model token markup | None stated; pay Portkey for logs/governance | None (you pay providers directly) | None on inference; fee on credits / BYOK overage |
| Virtual keys / budgets | Yes (budgeting on paid plans; RBAC Production+) | Yes in OSS; SSO/SCIM/audit on Enterprise | Workspace keys + BYOK provider keys |
| Routing / fallbacks | Universal API, fallbacks, load balancing, retries | Fallbacks, load balancing, Auto Routing | Auto provider fallback; :nitro / :floor / :exacto |
| Observability hooks | Logs, traces, feedback, alerts (Production+) | Request logs, Prometheus, team logging callbacks | Activity analytics; prompt logging opt-in |
| BYOK | Bring provider keys into Portkey vault / virtual keys | Your provider keys on your proxy | First-class BYOK with $25k/mo PAYG free allowance |
| Provider coverage | 1,600+ LLMs via unified API (vendor claim) | 140+ providers / ~1,892 models (vendor claim) | 500+ models on 80+ providers (homepage) |
| Owner (Oct 2026) | Palo Alto Networks (Prisma AIRS AI Gateway) | BerriAI / LiteLLM | OpenRouter |
How We Compared These Three Gateways
We read each vendor’s pricing page, product homepage, and the primary docs that define fees, BYOK, and Enterprise packaging on October 14, 2026, and captured the pages we cite. The lens is operational: who runs the proxy, how you pay, and which control surface you get before SSO and audit requirements appear.
- Primary sources only: prices and fee shapes come from Portkey pricing, LiteLLM pricing, and the OpenRouter FAQ plus BYOK docs.
- No paid bake-off: we did not load-test p99 overhead or judge model quality, so there are no star ratings.
- Estimates are labeled: any worked fee examples use published list prices and stated allowances.
- Related reading: for observability-side self-host choices see Arize Phoenix vs Langfuse vs Helicone; for tracing and eval platforms see Langfuse vs LangSmith vs Braintrust and Braintrust vs Maxim vs Galileo.
Pricing Shapes: Logs, Capacity, and Percent Fees
Gateway fees and model tokens are two separate lines on every honest budget. Portkey meters recorded logs on SaaS. LiteLLM OSS charges $0 license and optional Enterprise by request capacity. OpenRouter passes through provider rates and charges on credit purchases and over-allowance BYOK.
Portkey: log-metered SaaS plus optional self-host
Developer is free forever for 10k recorded logs per month with 3-day log and 30-day metrics retention. Production is $49/mo for 100k logs, then $9 per additional 100k up to 3M, with 30-day logs and 90-day metrics, per Portkey pricing. Enterprise is custom for 10M-plus logs, SSO, VPC hosting, BAAs, and longer retention.
Exceeding the recorded-log cap on Developer does not block requests; only logs beyond the limit stop being recorded. That matters when you model observability cost separately from inference cost.
LiteLLM: $0 OSS, Enterprise by gateway capacity
The MIT open-source gateway is free to self-host in production forever. LiteLLM Enterprise adds SSO, SCIM, audit logs, secret-manager hooks, and support, priced by annual gateway request capacity, deployment architecture, and support needs, never per token, per LiteLLM pricing and Enterprise docs.
Your ops team owns uptime; the license fee is optional until SSO and audit requirements appear. SSO is free for up to five users on the path LiteLLM documents; beyond that an Enterprise license is required.
OpenRouter: pass-through inference plus credit fees
OpenRouter passes through provider inference prices without markup and charges a 5.5% fee ($0.80 minimum) when you buy credits, or 5% for crypto, per the OpenRouter FAQ. Model spend is transparent; the platform fee sits on credit purchases and over-allowance BYOK.
# Rough monthly OpenRouter credit fee (not BYOK)
# If you buy $20,000 of credits: fee = max(0.80, 0.055 * 20000) = $1,100
# Provider inference still bills at listed rates inside those credits.Virtual Keys, Budgets, and Blast-Radius Limits
Virtual keys are how platform teams stop one leaked key or runaway agent from burning the whole org budget. Portkey and LiteLLM treat keys, budgets, and rate limits as first-class gateway controls. OpenRouter focuses on workspace API keys plus provider BYOK with optional guardrail budgets.
Portkey virtual keys and governance
Portkey packages universal API access with virtual keys, key management, and budgeting support on its paid plans, plus RBAC and service-account API keys on Production, per pricing and the homepage. Enterprise adds SSO, granular budget and rate limits, and org-wide audit logs.
Treat Portkey as the control plane for teams that want those policies without operating Redis, Postgres, and a proxy fleet themselves.
LiteLLM virtual keys and spend tags
LiteLLM OSS ships virtual keys, users and teams, spend tracking, budgets, rate limits, and tag-based spend attribution inside your VPC, per LiteLLM and docs. Enterprise layers SSO, SCIM, OIDC/JWT auth, audit logs, secret managers, and org/team admins on the same gateway image.
Hard budgets that stop requests at the cap are the difference between a proxy and an enterprise gateway. That is the control surface most SRE reviews ask for first.
OpenRouter keys and spend controls
OpenRouter issues API keys against a credit balance and supports organization management for teams. BYOK lets you attach provider keys with prioritized and fallback sections, model filters, and shared-capacity rules, per BYOK docs. Guardrail and workspace budgets can optionally include BYOK spend.
You get strong catalog access and billing aggregation. You do not get a self-hosted virtual-key database you operate inside your own network.
Routing, Fallbacks, and Provider Coverage
Routing decides whether a provider outage becomes a customer outage. All three advertise automatic fallbacks. Coverage claims differ in how they count models versus providers, so treat vendor tallies as directional and verify the models your apps actually call.
Portkey routing
Portkey’s AI Gateway documents a universal API with automatic fallbacks, load balancing, retries, and timeouts across a large model catalog (vendor homepage claims 1,600-plus LLMs), per AI Gateway features and Portkey. Guardrails and prompt management sit beside routing on the same control plane.
That packaging is why Portkey shows up when teams want governance and reliability features without assembling plugins themselves.
LiteLLM routing
LiteLLM routes an OpenAI-compatible API across 140-plus providers and roughly 1,892 models on its October 2026 homepage claims, with load balancing, lowest-cost routing, Auto Routing, and LLM fallbacks in OSS. You configure providers and keys in your own deployment, then swap models with config rather than app rewrites, per LiteLLM docs.
Day-zero model updates and self-hosted or fine-tuned backends behind the same key are the usual reasons platform teams standardize here.
OpenRouter routing
OpenRouter exposes hundreds of models across 80-plus providers with automatic provider fallback when a provider errors. Routing variants such as :nitro (throughput), :floor (price), and :exacto (tool-calling reliability) change sort order without changing your client schema, per the FAQ.
OpenRouter optimizes for catalog breadth and uptime pooling, not for running the proxy yourself. If residency requires terminating LLM traffic inside your VPC, you still need LiteLLM, Portkey OSS, or another self-host gateway.
Observability Hooks and Downstream Tracing
Gateways emit request logs and cost metrics; dedicated observability platforms own deep agent traces and evals. Wire the gateway you pick into the stack covered in our best AI agent observability tools guide rather than expecting one product to replace both layers.
- Portkey: logs, traces, feedback, custom metadata, filters; alerts on Production; longer retention and data-lake export on Enterprise.
- LiteLLM: request/response logging, Prometheus metrics, spend by key/team/tag; Enterprise adds team-based logging callbacks (for example separate Langfuse projects) and export paths.
- OpenRouter: Activity analytics for usage by model, provider, and API key; prompts and completions are not logged by default; opt-in logging trades a 1% discount for stored prompts.
For self-host observability shortlists, see open source LLM observability and the three-way Phoenix vs Langfuse vs Helicone comparison. For eval platforms, see AI agent evaluation tools.
Self-Host Versus SaaS: Who Runs the Proxy?
Self-host means you own patching, HA, and on-call for the gateway process. SaaS means you accept the vendor’s residency and retention model in exchange for not staffing that rotation.
| Question | Portkey | LiteLLM | OpenRouter |
|---|---|---|---|
| Default posture | Managed SaaS control plane | Self-host OSS first | Managed catalog API |
| Self-host option | Host it Yourself / OSS gateway | Primary path (Helm/Terraform/Docker) | Not offered as a control plane |
| Air-gap / VPC story | Enterprise private cloud / VPC hosting | OSS anywhere; Enterprise air-gap available | N/A (SaaS) |
| Who patches the proxy | Portkey (SaaS) or you (OSS) | You | OpenRouter |
| When it wins | Fast governance without gateway SRE | Residency + custom plugins + lowest license cost | Zero ops + huge catalog |
Portkey’s SaaS path is the managed default; its Host it Yourself column lists universal API, retries, routing, guardrails, automatic fallbacks, basic dashboard, and load balancing for teams that still want to deploy locally. LiteLLM’s entire product thesis is self-host. OpenRouter has no self-host control plane: BYOK still sends requests through OpenRouter’s routing layer.
BYOK and Credential Handling
Bring-your-own-key (BYOK) means provider credentials stay under your account while the gateway still routes and meters traffic. The three products implement that idea differently.
- Portkey: store provider keys in Portkey’s vault, expose virtual keys to apps, rotate and revoke centrally (Portkey).
- LiteLLM: provider keys live in your deployment (env, secret managers on Enterprise). Apps only see LiteLLM virtual keys (Enterprise docs).
- OpenRouter: attach provider keys in workspace BYOK settings. PAYG includes $25,000/mo list-price inference with no BYOK fee; usage above the allowance costs 5% of equivalent OpenRouter list price, deducted from credits (BYOK).
If your security review forbids third-party proxies from seeing prompts even with BYOK, you still need a self-host gateway such as LiteLLM terminating inside your network.
Ownership and Roadmap Caveats
Palo Alto Networks completed its acquisition of Portkey on May 29, 2026, per the closing press release. Prisma AIRS AI Gateway general availability was announced July 16, 2026, and Portkey’s site banners now point traffic at that branding.
Existing Portkey pricing pages still listed Developer, Production, and Enterprise terms on October 14, 2026. Re-check packaging, SSO, and support channels before you sign a multi-year agreement, especially if procurement expects a Palo Alto SKU rather than a Portkey invoice.
LiteLLM remains an independent open-source project with an optional Enterprise license. OpenRouter remains an independent catalog and billing aggregator. Neither has a comparable acquisition event in the windows we checked for this piece.
Portkey vs LiteLLM for Production Stacks
Portkey vs LiteLLM is a buy-versus-run decision once OpenRouter catalog convenience is off the table. Portkey wins when you want managed fallbacks, guardrails, and virtual keys this quarter. LiteLLM wins when residency, custom plugins, and $0 OSS license cost matter and you already have gateway operators.
- Choose Portkey for SaaS speed, log-metered pricing you can forecast off request volume, and packaged prompt/guardrail features.
- Choose LiteLLM for VPC/air-gap, Prometheus-native ops, and Enterprise add-ons only when SSO/SCIM/audit appear.
- Hybrid pattern: some teams run LiteLLM at the edge of private models and still use Portkey or OpenRouter for public-provider fan-out. Document which key owns which traffic.
LiteLLM vs OpenRouter for Catalog Access
LiteLLM vs OpenRouter is self-host control versus zero-ops catalog breadth. LiteLLM gives you virtual keys and budgets on your metal. OpenRouter gives you hundreds of models and provider fallbacks without running a proxy.
- Choose LiteLLM when provider keys must never leave your cloud and you will operate Helm/Docker.
- Choose OpenRouter when engineering time is scarcer than a 5.5% credit fee and you want :floor / :nitro routing tomorrow.
- Cost check: compare 5.5% of monthly credit buys (plus BYOK overage if any) against LiteLLM compute, Redis/Postgres, and on-call hours.
Portkey vs OpenRouter for Managed Paths
Portkey vs OpenRouter is governance packaging versus catalog aggregation. Both are managed. Portkey sells a control plane with logs, guardrails, and virtual keys. OpenRouter sells unified access and one bill across many providers.
- Choose Portkey when RBAC, prompt management, and recorded-log observability are the buying criteria.
- Choose OpenRouter when the buying criteria are model variety, provider failover, and pass-through list prices.
- Avoid double fees: do not put OpenRouter credits behind Portkey (or the reverse) without modeling both fee shapes.
Who Should Pick Portkey, LiteLLM, or OpenRouter
Match the gateway to ops capacity and fee shape, not to homepage model counts alone.
- Choose Portkey when you want a production SaaS gateway fast, with virtual keys and guardrails, and you can live with log-metered pricing. Confirm current Prisma AIRS packaging if you are buying through Palo Alto.
- Choose LiteLLM when you will run the gateway yourself and want the widest self-host provider coverage with budgets and virtual keys on day one.
- Choose OpenRouter when you want hundreds of models on one key and will accept a percent fee instead of running LiteLLM or Portkey yourself.
- Building agents on top? Pair the gateway with guidance from our AI agent frameworks pillar and keep traces in the tools covered by Langfuse alternatives.
Agent Engineering Desk rule: show the virtual key, the fallback, and the monthly fee lines before you standardize. Run a week of production-like traffic on the shortlist you can actually operate.
Decision Checklist
Print this list and score each option with platform engineering and finance in the room. The first option that clears every hard gate usually wins.
- Ops gate: Must the proxy run inside our VPC or air-gap? If yes, shortlist LiteLLM (or Portkey OSS), not OpenRouter SaaS.
- Fee gate: Are we optimizing for $0 license, predictable SaaS, or catalog convenience? Map to LiteLLM OSS, Portkey logs, or OpenRouter percent fees.
- Key gate: Do apps need per-team virtual keys with hard stop budgets? Prefer Portkey or LiteLLM over catalog-only setups.
- Catalog gate: Do we need same-day access to many third-party models without onboarding each provider? Bias to OpenRouter (or LiteLLM if you will configure providers).
- Ownership gate: Is Palo Alto / Prisma AIRS an approved vendor path for Portkey? Re-check before multi-year commits.
- Escape hatch: Keep dual-run for one week and a written rollback. Corrections: contact us.
Related AgentStack Guides
Not convinced by any of the three? Our 8 best LiteLLM alternatives roundup covers more routing gateways, with notes on budgets, fallbacks, and self-hosting.
Portkey, LiteLLM, and OpenRouter route models. When agents also need governed MCP tools, pair that choice with the patterns in MCP Explained.
Portkey, LiteLLM, and OpenRouter sit on the model path. For MCP server and tool governance, pair that choice with an MCP gateway that can enforce authz per tool call.
This comparison sits in the AI Gateways topic under AgentOps. Start from the AgentOps tools map, then drill into best AI agent observability tools, open source LLM observability, or Arize Phoenix vs Langfuse vs Helicone. Questions or corrections: contact us.
FAQ: Portkey vs LiteLLM vs OpenRouter
Is Portkey free to start for production traffic?
Developer is free forever for 10k recorded logs per month, which fits prototypes and light production. Production is $49 per month for 100k logs with longer retention and guardrails. Exceeding the free log cap does not block requests; only additional logs stop being recorded until you upgrade.
Is LiteLLM really free for production self-host?
Yes. LiteLLM documents that the MIT open-source gateway is free to self-host forever with virtual keys, budgets, rate limits, and fallbacks. Enterprise is optional and priced by annual gateway request capacity, architecture, and support, never per token. SSO beyond five users requires Enterprise on the documented path.
How does OpenRouter make money if inference has no markup?
OpenRouter passes through provider inference prices and charges a 5.5 percent fee with a $0.80 minimum when you buy credits, or 5 percent for crypto. BYOK on pay-as-you-go includes $25,000 per month of list-price inference with no BYOK fee, then 5 percent above that allowance.
Should we self-host LiteLLM or buy Portkey?
Self-host LiteLLM when residency, custom plugins, and lowest license cost matter and you already have gateway operators on call. Buy Portkey when you want managed fallbacks, guardrails, and virtual keys quickly, and you will accept log-metered SaaS pricing instead of running and patching the proxy yourself.
Portkey vs LiteLLM vs OpenRouter: which fits first?
Start with Portkey if you need a managed control plane this quarter. Choose LiteLLM if the proxy must live in your VPC with virtual keys and budgets. Choose OpenRouter if catalog breadth and one aggregated bill matter more than self-hosting, and model the 5.5 percent credit fee against engineering time.