Same AI gateway capability, independent, no feature gating.
In May 2026 Portkey was acquired by Palo Alto Networks and now runs as the AI gateway inside the Prisma AIRS security platform. nRouter remains the independent agent control plane: every feature on every plan, bought directly from its builder, not bundled into a security suite. Credit-based billing, built-in guardrails, and zero BYOK ship on every tier, so your team trades a virtual-key header dance for one OpenAI-compatible base URL. Every claim below about Portkey cites its public docs and is dated.
What changes on day one
- Platform fee on credits
- 4%
- Provider keys to manage
- 0
- Paywalled features
- None
- Migration time
- < 5 min
Flat 4% on top-ups, models at list price
We hold every credential — no BYOK
Every feature on every tier
Drop the virtual-key headers — base URL only
The capability matrix
Both gateways serve OpenAI-compatible APIs. The differences are pricing philosophy, feature gating, and provider-key ownership. Every marker is sourced below.
Comparison · sources verified September 2026
| Capability | nRouter | Portkey |
|---|---|---|
| Platform feeMarkup added on top of provider cost | Flat 4 %Flat 4 %7 | Usage-basedUsage-based1 |
| Model token pricing markupPer-token markup on provider list price (Rule #28) | 0 % markup (list price)0 % markup (list price)7 | Direct provider pass-through (BYOK)Direct provider pass-through (BYOK)1 |
| Provider key managementWho holds the provider credentials | Fully managed (no BYOK)Fully managed (no BYOK)7 | BYOK requiredBYOK required2 |
| OpenAI-compatible API | Included | Included |
| Built-in guardrailsPreflight PII redaction, prompt-injection detection, content filter ($0 held and $0 spent on blocked requests) | Included7 | Plan-dependentPlan-dependent3 |
| Role-based team managementDual-axis RBAC: Owner, Org Admin, Team Admin, Member, Viewer | Dual-axis (5 roles), every tierDual-axis (5 roles), every tier7 | Advanced RBAC on EnterpriseAdvanced RBAC on Enterprise4 |
| SSO / SAML | Every tierEvery tier7 | Enterprise planEnterprise plan4 |
| Audit logs | Every tierEvery tier7 | Enterprise planEnterprise plan4 |
| Built-in credit billingStripe-backed credit ledger with reserve + settle | Included | Not available5 |
| Per-team & per-key budgetsHard spend caps enforced in the request path | Hard caps, every tierHard caps, every tier7 | Rate limits documentedRate limits documented5 |
| Observability suiteLogs, latency percentiles, callbacks | Built-in, every tierBuilt-in, every tier7 | Available, plan-dependentAvailable, plan-dependent5 |
| Prompt managementVersioned templates + A/B variants | Templates + versioningTemplates + versioning7 | Prompt library / playgroundPrompt library / playground5 |
| Feature gating by tierAre core features paywalled? | Not available7 | Included4 |
| Contractual uptime SLA | 99.9 %99.9 %7 | Enterprise planEnterprise plan6 |
| Air-gapped zero-DB sidecar (Rule #33)Stateless mTLS sidecar with zero database access and zero external egress | Included | Not available |
| FinOps FOCUS 1.4 tokenomicsStandardized cost attribution and 3-way billing reconciliation | Included | Not available |
Sources & methodology
Competitor rows reflect each vendor's publicly documented plans and docs as last checked in September 2026; each cell links the specific source. Where a competitor's pricing or plan structure is not public, the cell describes the structure rather than quoting a figure — we never invent competitor pricing. Found something out of date? Email sales@nrouter.ai and we'll correct it.
- Portkey publishes a usage-based / per-request gateway price with paid plans layered above a free tier. The fee structure is documented; specific figures are not quoted here because they vary by plan. Portkey pricing tiers · Portkey pricing page · verified September 2026
- Portkey operates on a bring-your-own-key model: you provision, rotate, and audit each provider credential. Virtual keys abstract usage but the underlying provider accounts remain yours. Portkey (all plans) · Portkey docs — virtual keys · verified September 2026
- Portkey documents guardrails as a product capability; availability of specific guardrail checks and the volume allowance vary by plan tier. Treat the cell as "available, plan-dependent" rather than "free". Portkey Pro / Enterprise · Portkey docs — guardrails · verified September 2026
- Portkey documents SSO/SAML, advanced RBAC, and audit logging as Enterprise-plan capabilities rather than features available on the free or entry paid plan. Portkey Enterprise · Portkey pricing — Enterprise plan · verified September 2026
- Portkey provides usage analytics and cost observability. It does not ship a built-in customer billing / credit ledger — teams wire up billing themselves. Portkey (all plans) · Portkey docs · verified September 2026
- Portkey publishes uptime targets for its paid/enterprise plans. A contractual SLA percentage is associated with higher tiers rather than the free plan. Portkey Enterprise · Portkey site · verified September 2026
- nRouter platform fee is charged on top of provider cost, never deducted from purchased credits. Every product feature ships on every tier — plans change throughput ceilings and the nrouter/auto allowance, with a flat 4 % platform fee across plans. nRouter pricing · nRouter pricing page · verified September 2026
Credits are the product, not an afterthought
nRouter is built around a Stripe-integrated credit ledger with atomic reserve-and-settle. Every API call deducts in real time, every failure releases the reservation, and budgets are enforced before a request leaves the gateway. Portkey has no built-in billing. You wire up cost tracking yourself.
- Atomic reserve+settle ledger
- Per-key / per-team / per-org budgets
- Auto-topup + 402 error path
Step 01 — Cortex safety inspection
Guardrail Preflight
Cortex sidecar evaluates injection and moderation over mTLS 1.3. Blocked attacks halt with HTTP 400 ($0 held, $0 spent).
Step 02 — pre-flight hold
Reserve
Credits reserved atomically only after guardrails pass. Budget caps enforced here, not after the fact.
Step 03 — egress & settle
Settle
Actual provider cost settles against the reservation in real time: per key, per team, per org.
Frequently asked questions
Common questions about switching from Portkey to nRouter.
Is nRouter cheaper than Portkey?
It depends on which features you need. Portkey gates advanced governance (SSO, audit logs, advanced RBAC) to its Enterprise plan; nRouter includes them on every plan. nRouter charges Pay-as-you-go carries a platform fee of 4% of your credits (added on top, so you receive every credit you buy) with no minimum fee. The Pro and Max monthly plans add a usage allowance for nrouter/auto, and credit top-ups on every plan carry the same fee on top. Always on top of provider cost, never deducted from credits. We do not quote Portkey's figures; see the sourced footnotes under the comparison table.
Can I switch from Portkey to nRouter?
Yes. Both nRouter and Portkey use the OpenAI-compatible API format. Change your base URL to https://api.nrouter.ai/v1 and swap your API key. You can also drop Portkey's virtual-key headers. Migration takes under five minutes.
Does nRouter have observability like Portkey?
Yes, and it is genuine common ground. nRouter includes real-time request logging, cost tracking per model/team/key, latency percentiles, error-rate monitoring, and callbacks to Langfuse, Datadog, S3, and Slack. The difference is nRouter does not tier observability. It is included on every plan.
What does nRouter have that Portkey does not?
A Stripe-backed credit billing system with atomic reserve-and-settle, per-team and per-key budget caps enforced in the request path, and a fully-managed (no BYOK) provider-key model. nRouter also includes SSO/SAML and audit logs on every tier, where Portkey documents them on its Enterprise plan.
Is Portkey still independent after the Palo Alto Networks acquisition?
Palo Alto Networks completed its acquisition of Portkey on May 29, 2026, and Portkey now operates as the AI gateway inside the Prisma AIRS security platform (per Palo Alto Networks' May 2026 announcement). That is a good fit if you are standardizing on Prisma AIRS. nRouter is independent and stays that way: you buy the gateway directly from its builder, every feature ships on every plan, and there is no security-suite bundle to adopt to get budgets, guardrails, SSO, or audit logs.
Are all nRouter features really included on every tier?
Every product feature — guardrails, prompt management, A/B tests, evals, observability, RBAC, SSO/SAML, audit logs, per-team budgets, and priority support — ships on every tier. Tiers differ primarily on the RPM/TPM throughput guarantee (with a flat 4 % platform fee on credit top-ups across plans and no minimum fee). Nothing else is gated.
How current is this comparison?
Every Portkey row links the specific public page it is drawn from and a last-verified month (currently September 2026). Where Portkey's pricing or plan structure is not public, the cell describes the structure instead of quoting a figure. We never invent competitor pricing.
No BYOK · 5-minute migration
Why sign five contracts when one key runs them all?
nRouter replaces separate provider contracts, invoices, and rate limits: one OpenAI-compatible key for 169+ models, on a single bill. Less procurement, more shipping.
Need help moving over? sales@nrouter.ai for white-glove migration.99.9% SLA