Compare
Doorman vs Kong Gateway
Kong is one of the most widely deployed API gateways, with a large plugin ecosystem and a commercial platform around it. Doorman is a smaller, Rust-based gateway with a built-in dashboard for users and subscriptions, and AI governance for employees included at no cost.
In short
- Choose Kong for very large or Kubernetes-native deployments, a broad plugin ecosystem, TCP and UDP traffic, or a vendor with enterprise support and a developer portal.
- Choose Doorman for a self-contained gateway with users, roles, subscriptions, quotas and logs in its own dashboard, plus per-employee AI keys, dollar allowances and guardrails without paid add-ons.
- Both have Apache 2.0 open-source editions. Kong sells Kong Enterprise and Kong Konnect for many advanced features; Doorman has no paid edition.
At a glance
How they compare.
| Feature | Doorman | Kong Gateway |
|---|---|---|
| Built on | Rust | NGINX and OpenResty (Lua) |
| License | Apache 2.0, every feature | Apache 2.0 open-source edition; paid Enterprise and Konnect |
| Protocols | REST, GraphQL, gRPC, gRPC-Web and SOAP | HTTP, gRPC, GraphQL, WebSockets, TCP and UDP |
| Dashboard | Built in: APIs, users, roles, groups, subscriptions, tiers, logs | Kong Manager; more in paid editions |
| Users and subscriptions | Built in, with credits, tiers and quotas | Consumers and plugins; developer portal in paid editions |
| AI gateway | Personal keys, allowances, guardrails and spend reports, free | AI plugins; several advanced ones are in paid editions |
| Extending it | Configuration, not plugins | Large plugin ecosystem; write your own in Lua, Go, Python or JavaScript |
| Configuration store | In memory, or MongoDB and Redis | PostgreSQL, or DB-less declarative config |
| Kubernetes | Runs as a container | Ingress controller and Gateway API support |
Where Kong fits better
Pick Kong for scale and ecosystem.
- Proven at very large scale
- Kong runs in front of very large production estates and has years of operational guidance behind it.
- Plugins for almost anything
- If you need a specific auth scheme, transformation or integration, there is likely a Kong plugin for it, or you can write one.
- Kubernetes-native
- The Kong Ingress Controller and Gateway API support fit clusters managed entirely through Kubernetes resources.
- Layer 4 and enterprise buying
- Kong proxies TCP and UDP streams, and offers enterprise support, compliance paperwork and a hosted control plane.
Where Doorman fits better
Pick Doorman for a complete gateway in one container.
- People and access built in
- Users, roles, groups, subscriptions, credits, tiers and quotas are managed in the dashboard, not assembled from plugins.
- AI governance included
- Each employee gets a personal key and an allowance in dollars, tokens or requests. Guardrails redact secrets before prompts leave, and spend is reported by person and model.
- SOAP and gRPC alongside REST
- Older SOAP services, gRPC and GraphQL sit behind the same policies, logs and analytics as REST.
- No paid tier
- Everything above is in the Apache 2.0 repository. Help is available as a scoped pilot if you want it.
Try it
See the AI side in a few minutes.
The demo runs Doorman with a keyless local model, an allowance and an employee key, and shows a request being blocked at the limit.
cp .env.demo .env
docker compose -f docker-compose.yml -f docker-compose.demo.yml up
./scripts/demo-ai-walkthrough.shFAQ
Common questions.
Can't find your answer? The documentation covers setup, operations, and the AI gateway in detail.
Read the documentationCan Doorman replace Kong?
For HTTP, GraphQL, gRPC and SOAP APIs that need authentication, users, rate limits, quotas, versioning and logs, often yes. If you rely on specific Kong plugins, TCP or UDP proxying, or Kubernetes ingress, Kong is the better fit.
Can I put Doorman behind Kong?
Yes. Many teams keep their edge gateway and run Doorman behind it for AI traffic, so employees get personal keys and allowances without changing the edge.
Does Doorman have plugins?
No. Features are configured in the dashboard or API rather than added as plugins.
Related
Keep reading.
Run it next to your current gateway.
Start with AI traffic or one internal API, compare the logs and limits, then decide.