Which AI gateway should you run in 2026: managed or self-hosted?

What an AI gateway does, and why it is a key vault with an HTTP port

An AI gateway is a proxy that sits between your application and model providers, exposing one OpenAI-compatible endpoint while handling retries, fallbacks, caching, rate limits, spend tracking and request logs. Cloudflare, Vercel, Portkey and OpenRouter sell it as a managed service. LiteLLM is the self-hosted option most teams start with, because a single container gives you virtual keys, budgets and per-team spend without a contract.

The architectural detail that matters for this comparison: a gateway terminates every request with real provider credentials. In a managed setup those keys live in the vendor's vault. In a self-hosted setup they live in your Postgres, usually in a table the gateway reads on every call. That is a normal design, and it is also why the October 2026 LiteLLM incident was not a routine dependency update.

The two shapes also fail differently. A managed gateway can break your budget or your data-residency story, because prompts and completions pass through someone else's infrastructure. A self-hosted gateway can break your week, because you own the patch window, the upgrade path and the credential rotation when its release pipeline is compromised.

What the LiteLLM 1.107.0 compromise actually exposed

LiteLLM's own incident report says the release pipeline was compromised at about 11:40 UTC on October 21, 2026 and pushed v1.107.0 to PyPI and the container registries. The package was live on PyPI from 11:39:51 to 13:23 UTC. The Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable pointed at the malicious images from 11:46:56 to 14:20 UTC. LiteLLM states the official GitHub source tag was clean and the malicious artifacts were built from an attacker-controlled repository.

SafeDep's analysis of the wheels is the part buyers should read. Installing litellm==1.107.0 dropped three files into site-packages. cook.pth contains a single import line, so the stealer ran in every Python process on the host, whether or not the code imported litellm. sitecustomize.py started a detached daemon that polled a GitHub file hourly and executed whatever code it pointed at. The injected build line was one setting in the sdist pyproject.toml: data = "cook" under the maturin section, with no matching commit in the public repository.

What the stealer collected explains why gateway operators were the worst-hit group: SSH keys, cloud credentials, CI/CD secrets, browser passwords, and the Claude Code, Cursor, Codex and Copilot tokens on developer machines. It also read DATABASE_URL and dumped the LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable, which hold the provider API keys of the LiteLLM proxy. One compromised gateway host, in other words, was enough to expose every model provider key the company owned.

The initial access is the least comforting detail. LiteLLM believes the attacker obtained the GitHub CLI credentials of three developers, taken from the logs of an internal LiteLLM deployment that was exposed to the internet, then used an organization owner token to bypass branch protection and point the release workflow at a lookalike repository. That is a supply-chain attack on a security-sensitive proxy, run through the proxy's own logs.

AI gateway pricing, verified on official pages (October 24, 2026)

Every figure below was read on the vendor's own pricing or docs page on October 24, 2026. None of it is an estimate, and none of these vendors publish a comparison against the others.

Cloudflare AI Gateway is the cheapest managed starting point because there is no subscription at all: dashboard analytics, caching and rate limiting are free on every plan, DLP scanning is free, and the 5% charge applies only to credits purchased through Unified Billing. Log storage is capped at 100,000 logs total across all gateways on Workers Free, and 10,000,000 logs per gateway on Workers Paid, so the log volume is where a bill can appear.

Vercel AI Gateway charges no markup and no platform fee on tokens, and it does not require your app to run on Vercel. The free tier includes $5 per month of credits against a subset of models with lower rate limits; the paid tier is prepaid credits at provider list price, and BYOK is available on the paid tier.

OpenRouter is priced as a platform fee rather than a subscription: 5.5% on Standard credits, 8% on Business, and no fee on the free tier, which covers 25 or more free models at 50 requests per day. Its BYOK allowance is the most generous published number in this group, with $25,000 of list-price inference per month at no fee on Standard and a 5% fee above that.

Portkey is the only vendor here with a flat monthly price for the gateway itself: free for 10,000 recorded logs per month with 3-day log retention, then $49 per month for 100,000 logs, 30-day log retention and a $9 charge per additional 100,000 requests. Enterprise pricing is custom.

LiteLLM is $0 to self-host, forever, per its own pricing page. The Enterprise tier adds SSO, SCIM, audit logs, secret managers with key rotation and 24/7 support, priced annually and quoted by sales rather than published.

Managed or self-hosted: the split that actually decides it

The pricing gap is small enough that cost is rarely the deciding factor. A team spending $500 a month on tokens pays $0 on Vercel, $25 to $40 on OpenRouter, $49 on Portkey, or $0 on LiteLLM plus the salary time to run it. The real question is who holds the keys and who owns the patch window.

• Pick a managed gateway if you cannot guarantee a same-day patch of an internet-facing proxy, if you want the vendor to absorb the supply-chain risk, or if your team has no platform engineer. Cloudflare is the natural fit when you already route through its network and want free core features; Vercel fits teams that want zero markup and prepaid credits; Portkey fits teams that want guardrails and prompt management in the same console; OpenRouter fits teams that want one key across hundreds of models and are comfortable with a percentage fee.
• Pick self-hosted LiteLLM if prompts cannot leave your VPC, if you need routing logic no vendor exposes, or if you already run Postgres and a deployment pipeline. Budget for the operational side: pinned versions, hash-checked installs, a rebuild-on-CVE habit, and someone on call when a release looks wrong.
• Do not self-host as a cost saving. LiteLLM is free, and the LiteLLM incident shows what the hidden line item looks like when a release goes bad: rotating every provider key, every cloud role, and every developer token that touched the host.

One hybrid worth knowing: managed gateways with BYOK. You keep the provider keys at the vendor but pay no token markup on some plans, which shrinks the fee without shrinking the blast radius on your own infrastructure. If your security review is the binding constraint, that is usually the better trade than self-hosting on a team without platform coverage.

If you ran LiteLLM 1.107.0, the remediation order matters

LiteLLM's incident report is unusually direct about sequence: do not start with pip install, because any Python start in the affected environment runs cook.pth and sitecustomize.py again, and that includes pip itself. From a shell, delete cook.pth, cook.py, sitecustomize.py and the matching __pycache__ files from every affected site-packages, then kill the detached daemon holding /tmp/remote_code_loader.lock, then reinstall pinned to litellm==1.106.2. Rebuilding the image or venv from scratch is better than cleaning it.

Assume the exfiltration succeeded if 1.107.0 ever ran on a host with outbound internet. The report says the marker file confirms exfiltration when present, but a missing marker proves nothing, because containers and tmp cleanup remove it. Rotate everything the host could reach: the instance or task IAM role, every provider key stored in the LiteLLM proxy database, and the master and virtual keys derived from DATABASE_URL.

Two verification steps are worth doing even if you think you were unaffected. Run pip show litellm to confirm the installed version, and check whether any container image digest matches sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e, the compromised Docker Hub index. LiteLLM also states that customers on its private enterprise registry were not affected, which is a fair argument for paying for a vendor that ships embargoed fixes through a channel you control.

Five questions to ask before you sign an AI gateway contract

The pricing pages answer the fee question and almost nothing else. These are the questions that decide whether the invoice is the whole cost.

1. Where do provider keys live, and can I bring my own KMS? If the answer is a vendor-managed vault with no customer key option, you are trusting their incident response with every model key you own.
2. Do prompts leave my region? Vercel and Portkey both advertise regional and zero-data-retention controls; check that the specific control exists on the tier you are buying, not only on the enterprise brochure.
3. What is the log retention and who can read it? Logs contain prompts. Cloudflare's free plan caps storage at 100,000 logs total, Portkey's free tier keeps 3 days, and longer retention is the usual upsell.
4. What is the BYOK ceiling and the fee above it? OpenRouter publishes $25,000 per month at no fee then 5%; that number matters more than the headline platform fee for heavy users.
5. Can I pin a version or digest, and will you tell me when you cannot? The LiteLLM breach was live for under two hours and still reached production installs through floating tags. A gateway that lets you pin by digest and publishes signed releases removes most of that exposure.

If a vendor cannot answer the first and fifth questions in writing, price the alternative on the assumption that you will be the one rotating keys at 2 a.m.

At a glance

AI gateway pricing and terms, verified on official vendor pages on October 24, 2026

FAQ

Is LiteLLM free to self-host?

Yes. LiteLLM's pricing page lists the open-source gateway at $0, free forever, including virtual keys, spend tracking, budgets, fallbacks and Prometheus metrics. Enterprise adds SSO, SCIM, audit logs, secret managers with key rotation and 24/7 support, and is quoted annually rather than published.

Is Cloudflare AI Gateway free?

The core features are free on every plan: analytics, caching, rate limiting and DLP scanning. The only built-in charge is a 5% fee on credits purchased through Unified Billing, so a $100 top-up costs $105, while inference itself is passed through at provider list price.

Which AI gateway is cheapest if I bring my own provider keys?

Vercel AI Gateway charges no markup and no platform fee and supports BYOK on its paid tier. OpenRouter gives Standard customers $25,000 of list-price inference per month with no fee and charges 5% above that. Cloudflare's 5% applies only to Unified Billing credits, so requests made with your own provider keys carry no gateway fee.

Related reading

what Cloudflare AI Gateway costs, LiteLLM vs OpenRouter, OpenRouter alternatives

Sources

• LiteLLM security incident report, October 21, 2026
• SafeDep analysis of the compromised LiteLLM 1.107.0 wheels
• Cloudflare AI Gateway pricing docs
• Vercel AI Gateway pricing docs
• OpenRouter pricing
• Portkey pricing
• LiteLLM pricing