LiteLLM vs Portkey vs Cloudflare AI Gateway
Every one of these solves 'talk to many providers through one interface'. They differ sharply on where your prompts physically travel, which is a compliance question before it is a technical one.
Short answer
Self-host LiteLLM if you need breadth and control; it is the least committal. Choose Portkey if you want a managed product with guardrails included and are comfortable with a SaaS dependency.
By Lattice editorial · Licence and cost facts verified · method
- LiteLLMWidest provider coverage, self-host friendly.
- PortkeyGateway plus guardrails and analytics, SaaS-first.
- Cloudflare AI GatewayEdge network, caching close to users.
- Envoy AI GatewayCNCF, for Kubernetes shops that already run Envoy.
| Dimension | LiteLLM | Portkey | Cloudflare AI Gateway | Envoy AI Gateway |
|---|---|---|---|---|
| Deployment | Self-host or cloud | Cloud-first, self-host available | Managed edge service | Self-host in your cluster |
| Provider count | 100+ | Broad | Broad | Plugin-driven |
| Caching | Redis-backed, including semantic | Yes | Yes, at the edge | Via the data plane |
| Routing logic | Yours — config plus code | Policy engine, mostly declarative | Simple rules at the edge | Yours, expressed as Envoy config |
| Where prompts go | Your infrastructure, if self-hosted | Vendor SaaS unless self-hosted | Through Cloudflare's edge | Never leaves your cluster |
Scroll the table sideways to see every tool.
What this table is not. These are editorial judgements, not benchmarks: Lattice has not run these tools head to head, and no cell uses GitHub stars or vendor benchmark claims as evidence. Licence and cost facts are re-checked on a schedule the build enforces — the receipt is public.
The recommendation
Which should you choose: LiteLLM, Portkey, Cloudflare AI Gateway or Envoy AI Gateway?
Self-host LiteLLM if you need breadth and control; it is the least committal. Choose Portkey if you want a managed product with guardrails included and are comfortable with a SaaS dependency. Cloudflare AI Gateway is the pick when latency and edge caching dominate, and Envoy AI Gateway when you need a gateway that never sees traffic leave your network.
Rules of thumb
- Put a gateway in front of your provider calls early, even if it only does auth and logging. It is the only place that sees the whole request.
- Never put prompt construction in the gateway. It is a control plane, not application logic.
- Budgets are only enforceable where spend is attributed, which means identity has to propagate from the gateway inward.
Quick answers
- When should you use LiteLLM, and when should you skip it?
- Use LiteLLM when: the widest provider coverage, deployed the least committal way. Skip it when: you want routing policy to live in a SaaS console.
- When should you use Portkey, and when should you skip it?
- Use Portkey when: a managed gateway with guardrails and analytics already bundled. Skip it when: prompts cannot leave your infrastructure.
- When should you use Cloudflare AI Gateway, and when should you skip it?
- Use Cloudflare AI Gateway when: edge caching and latency dominate, on Cloudflare already. Skip it when: requests must not transit a third party's network.
- When should you use Envoy AI Gateway, and when should you skip it?
- Use Envoy AI Gateway when: a Kubernetes shop that already runs Envoy and needs the gateway in-cluster. Skip it when: you want a gateway configurable without a data plane.