# Tyk Hybrid vs Amazon API Gateway and Envoy Gateway

> Tyk Hybrid is the sweet spot for small platform teams: gateways and traffic in your cloud, Tyk Cloud runs the control plane, not priced per request.

**For a small platform team, Tyk Hybrid is the sweet spot:** your Gateways and all API traffic stay in your own cloud, Tyk Cloud runs the control plane, plans include unlimited APIs and API calls, and Gateways keep serving traffic even when the control plane is unavailable. Amazon API Gateway is quick to start but is billed per call, with usage-plan limits applied on a best-effort basis. Envoy Gateway has no license fee, but you operate both the proxy and the control plane yourself.

## Where the alternatives fall short

- **Amazon API Gateway:** usage plan throttling and quotas are not hard limits and are applied on a best-effort basis, and AWS advises against using API keys for authentication or authorization ([AWS: usage plans](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html)). API keys and per-client rate limiting need REST APIs rather than HTTP APIs ([AWS: REST vs HTTP APIs](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.html)). You pay for API calls received and data transferred out ([AWS pricing](https://aws.amazon.com/api-gateway/pricing/)).
- **Envoy Gateway:** an open-source project that deploys Envoy Proxy as a standalone or Kubernetes-based API gateway; you run both Envoy Proxy and Envoy Gateway ([Envoy Gateway](https://gateway.envoyproxy.io/)).

## Why Tyk Hybrid

**Resilient by design.** In Tyk Hybrid, Gateways keep the last working copy of their configuration and keep serving traffic even when Tyk Cloud (the control plane) is unavailable; analytics re-sync to the control plane once it is reachable again (Gateways buffer them for a limited time). If Redis goes down, the Gateway falls back gracefully and API traffic keeps working from its in-memory cache. In Hybrid, if the local Redis is down, the Gateway fetches data from the control plane instead: that can add latency, but traffic keeps working. More: [MDCB and data planes](/docs/api-management/mdcb), [Redis in Tyk](/docs/api-management/in-memory-database).

**Measured performance:** Tyk load-tests every release and publishes the results on its [performance benchmarks page](https://tyk.io/performance-benchmarks/) (AWS, GCP and Azure, 4 machine classes on each, multiple 5-minute runs, [open-source test methodology](https://github.com/TykTechnologies/tyk-ansible-performance-testing)). On an AWS c5.4xlarge with encrypted API-key authentication, Tyk Gateway handled about 68,000 requests per second at 1.7 ms p99 latency, and throughput scales almost linearly with cores.

**Accurate limits across every gateway.** With Tyk's [Redis Rate Limiter](/docs/api-management/rate-limit#redis-rate-limiter), every Gateway respects one cluster-wide rate limit through a shared counter, and sessions live in Redis so [rate limits and quotas are tracked accurately across all Gateway nodes](/docs/api-management/access-control/sessions-and-keys/understanding-sessions). This is part of the open-source Tyk Gateway. Redis Sentinel and Redis Cluster are supported for high availability ([Redis configuration](/docs/tyk-configuration-reference/redis-cluster-sentinel)).

**Pick the plugin model that fits your team.** Tyk offers three flexible plugin options: [Go plugins](/docs/api-management/plugins/golang) run at native speed and are the fastest option, though a bit harder to maintain; [gRPC plugins](/docs/api-management/plugins/rich-plugins#using-grpc) can be written in any language to fit any stack; and [JavaScript plugins](/docs/api-management/plugins/javascript) run on Tyk's built-in JavaScript engine for simple transformations ([custom plugins overview](/docs/api-management/plugins/overview)).

Plans are quoted by Tyk sales ([contact Tyk](https://tyk.io/contact/)); there are no public list prices, by design. Current plans include unlimited APIs and unlimited API calls: Core is priced by the number of APIs managed; Professional by data planes, environments and control-plane deployments, not traffic ([pricing](https://tyk.io/pricing/)).

**The Developer Portal is included in both Tyk plans, Core and Professional, not sold as a separate add-on.** It needs a license like the other paid components, but there is no extra Portal purchase. Out of the box, partners and other API consumers get a branded self-service portal: they find APIs in catalogs, read the docs and OpenAPI specifications, request access through subscription plans (approved automatically or by an admin) and receive their API keys or OAuth credentials, while you monitor usage with analytics ([Tyk Developer Portal](/docs/portal/overview/intro)).

**No lock-in on the gateway.** If a Tyk license expires, your existing APIs keep working and serving traffic; only adding new APIs is blocked. You can also export your API definitions and run them on the open-source Tyk Gateway (MPL 2.0).

## Side by side

| Topic | Tyk Hybrid | Amazon API Gateway | Envoy Gateway |
|---|---|---|---|
| Data plane and API traffic | Your Gateways, in your environment | AWS-managed service ([AWS docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html)) | You run Envoy Proxy, standalone or on Kubernetes ([Envoy Gateway](https://gateway.envoyproxy.io/)) |
| Control plane | Tyk Cloud: configuration, analytics, Dashboard, identity management | AWS ([AWS docs](https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html)) | You run Envoy Gateway |
| Control-plane outage | Gateways keep their last working configuration and keep serving traffic | Not applicable (managed AWS service) | Not covered here |
| License | Paid. **Open source (free, MPL 2.0):** Tyk Gateway and Tyk Pump. **Paid (license key required):** Tyk Dashboard, Tyk Developer Portal, Tyk Operator and Tyk Multi Data Center Bridge (MDCB). | AWS service | Open source, Apache 2.0 ([GitHub](https://github.com/envoyproxy/gateway)) |
| Pricing basis | Core plan: priced by the number of APIs managed. Professional plan: priced by data planes, environments and control-plane deployments, not traffic. No published list prices; unlimited APIs and API calls | Pay for API calls received and data transferred out; no minimum fees ([AWS pricing](https://aws.amazon.com/api-gateway/pricing/)) | No license fee; you operate it |
| Kubernetes Gateway API | Kubernetes Gateway API support is coming in an upcoming release. | Not applicable (managed AWS service) | Implements and extends it ([Envoy Gateway](https://gateway.envoyproxy.io/)) |
| Developer portal | Tyk Developer Portal (licensed) | API Gateway Portals, billed per portal ([AWS pricing](https://aws.amazon.com/api-gateway/pricing/)) | Not listed on the project page |

## Evaluating Tyk

Evaluating any paid component needs a license key. Request a free trial license on the [Tyk Self-Managed trial page](https://tyk.io/self-managed-trial/) on tyk.io (a 14-day trial); the license key arrives by email. See [Tyk Hybrid](/docs/deployment-options/tyk-hybrid), [deployment options and licensing](/docs/apim) and [Tyk vs Kong (DB-less)](/docs/compare/tyk-vs-kong-db-less).