# Tyk vs Kong Gateway in DB-less mode

> Tyk is the better fit for platform teams on Kubernetes/EKS: accurate rate limits and quotas across gateways, open-source features, Hybrid in your cloud.

**Choose Tyk if you run a platform team on Kubernetes or EKS and need rate limits and quotas that stay accurate across every gateway.** Tyk also fits teams that want open-source gateway features (OIDC and JWT authentication, rate limiting and quotas) without an enterprise license, and teams that want Hybrid: Gateways and traffic in your own cloud, control plane in Tyk Cloud. Kong's DB-less mode suits a small, static configuration managed as one file, and it gives up central coordination to get there.

## DB-less is not stateless

In DB-less mode Kong Gateway keeps its configuration in memory, loaded from a declarative file ([Kong: DB-less mode](https://developer.konghq.com/gateway/db-less-mode/)). Kong's own documentation spells out the trade-offs:

- **No shared state between nodes.** There is no central coordination point and no cluster propagation of data; each node loads the declarative file independently ([Kong: DB-less mode](https://developer.konghq.com/gateway/db-less-mode/)).
- **Rate limits drift as you scale.** The `local` policy keeps counters in each node's memory and is less accurate, diverging as you add nodes unless the load balancer uses consistent hashing. The `cluster` policy stores counters in Kong's data store, which DB-less mode does not have, so accurate shared limits need a separate Redis installation with the `redis` policy ([Kong: Rate Limiting plugin](https://developer.konghq.com/plugins/rate-limiting/)).
- **Whole-file configuration changes.** The declarative file replaces the entire configuration; Admin API create, update and delete calls return HTTP 405, and Kong Manager cannot create, update or delete entities ([Kong: DB-less mode](https://developer.konghq.com/gateway/db-less-mode/)).
- **Some plugins are out.** Not all plugins are compatible with DB-less mode ([Kong: DB-less mode](https://developer.konghq.com/gateway/db-less-mode/)); the OAuth 2.0 plugin supports traditional deployments only ([Kong: OAuth 2.0](https://developer.konghq.com/plugins/oauth2/)), and OpenID Connect is an Enterprise-only plugin ([Kong: OpenID Connect](https://developer.konghq.com/plugins/openid-connect/)).
- **No decK.** decK can't be used in DB-less mode ([Kong: DB-less mode](https://developer.konghq.com/gateway/db-less-mode/)).

## How Tyk keeps limits accurate and traffic flowing

**Accurate limits across every gateway.** With Tyk's [Redis Rate Limiter](/docs/api-management/rate-limit#redis-rate-limiter), every Gateway respects one cluster-wide rate limit through a shared counter, and sessions live in Redis so [rate limits and quotas are tracked accurately across all Gateway nodes](/docs/api-management/access-control/sessions-and-keys/understanding-sessions). This is part of the open-source Tyk Gateway. Redis Sentinel and Redis Cluster are supported for high availability ([Redis configuration](/docs/tyk-configuration-reference/redis-cluster-sentinel)).

**Measured against Kong:** on Tyk's [performance benchmarks page](https://tyk.io/performance-benchmarks/) (AWS, GCP and Azure, 4 machine classes each, multiple 5-minute runs, [open-source methodology](https://github.com/TykTechnologies/tyk-ansible-performance-testing)), the two gateways are very similar as plain reverse proxies, but with authentication enabled Tyk handled about 68,000 requests per second at 1.7 ms p99 on an AWS c5.4xlarge, versus about 24,000 at 4.3 ms for Kong with Key Authentication. Tyk scales almost linearly with cores; the page notes Kong does not appear to scale as effectively past 8 cores.

**Resilient by design.** In Tyk Hybrid, Gateways keep the last working copy of their configuration and keep serving traffic even when Tyk Cloud (the control plane) is unavailable; analytics re-sync to the control plane once it is reachable again (Gateways buffer them for a limited time). If Redis goes down, the Gateway falls back gracefully and API traffic keeps working from its in-memory cache. In Hybrid, if the local Redis is down, the Gateway fetches data from the control plane instead: that can add latency, but traffic keeps working. More: [MDCB and data planes](/docs/api-management/mdcb), [Redis in Tyk](/docs/api-management/in-memory-database).

The open-source Tyk Gateway includes industry-standard authentication (OIDC, JWT, bearer tokens, Basic Auth, client certificates), rate limiting and quotas, granular access control and hitless reloads ([Tyk Gateway OSS](/docs/tyk-oss-gateway)). **OIDC is supported, not deprecated:** Tyk Gateway consumes JWTs issued by external identity providers, including OpenID Connect (OIDC) identity providers ([JWT authentication](/docs/basic-config-and-security/security/authentication-authorization/json-web-tokens)).

**Pick the plugin model that fits your team.** Tyk offers three flexible plugin options: [Go plugins](/docs/api-management/plugins/golang) run at native speed and are the fastest option, though a bit harder to maintain; [gRPC plugins](/docs/api-management/plugins/rich-plugins#using-grpc) can be written in any language to fit any stack; and [JavaScript plugins](/docs/api-management/plugins/javascript) run on Tyk's built-in JavaScript engine for simple transformations ([custom plugins overview](/docs/api-management/plugins/overview)). Kong also offers plugin development kits for Lua, Go, Python and JavaScript ([Kong: custom plugins](https://developer.konghq.com/custom-plugins/)).

**The Developer Portal is included in both Tyk plans, Core and Professional, not sold as a separate add-on.** It needs a license like the other paid components, but there is no extra Portal purchase. Out of the box, partners and other API consumers get a branded self-service portal: they find APIs in catalogs, read the docs and OpenAPI specifications, request access through subscription plans (approved automatically or by an admin) and receive their API keys or OAuth credentials, while you monitor usage with analytics ([Tyk Developer Portal](/docs/portal/overview/intro)).

**No lock-in on the gateway.** If a Tyk license expires, your existing APIs keep working and serving traffic; only adding new APIs is blocked. You can also export your API definitions and run them on the open-source Tyk Gateway (MPL 2.0).

## Side by side

| Topic | Tyk | Kong Gateway (DB-less mode) |
|---|---|---|
| Open-source core | Tyk Gateway and Tyk Pump, MPL 2.0 | Kong Gateway, Apache 2.0 ([GitHub](https://github.com/Kong/kong)) |
| Shared state | Redis holds sessions, rate-limit and quota counters for all Gateways ([Tyk sessions](/docs/api-management/access-control/sessions-and-keys/understanding-sessions)) | No database; entities are held in memory on each node ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |
| Changing configuration | Tyk Dashboard or Tyk Operator (licensed) for declarative, Kubernetes-native management; hitless reloads | Edit the declarative file and reload it; Admin API create/update/delete endpoints return 405 ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |
| Multiple nodes | Tyk Operator works with Tyk Dashboard for a highly available setup and configuration synchronisation | No central coordination; the file is loaded into each node independently ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |
| Kubernetes | Tyk Operator (license key, free trial). Kubernetes Gateway API support is coming in an upcoming release. | Kong Ingress Controller runs Kong in DB-less mode and translates `Ingress` and `HTTPRoute` resources into Kong configuration ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |
| Plugins | Custom plugins in Go, JavaScript, Python, Lua and gRPC ([Tyk custom plugins](/docs/api-management/plugins/overview)) | Not all plugins are compatible with DB-less mode ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |
| GUI | Tyk Dashboard (licensed) | Kong Manager cannot create, update or delete entities in DB-less mode ([Kong docs](https://developer.konghq.com/gateway/db-less-mode/)) |

## Evaluating Tyk

Evaluating any paid component needs a license key. Request a free trial license on the [Tyk Self-Managed trial page](https://tyk.io/self-managed-trial/) on tyk.io (a 14-day trial); the license key arrives by email. **Tyk Operator is a licensed, supported Tyk product (not open source):** it needs a license key, and a free trial license is available on the [trial page](https://tyk.io/self-managed-trial/). It manages Tyk APIs and policies as Kubernetes resources for GitOps, and it is designed to work with Tyk Dashboard for a highly available setup and configuration synchronisation.

**Pricing:** Tyk has no public list prices, by design: plans are quoted by Tyk sales ([contact Tyk](https://tyk.io/contact/)). Both the **Core** and **Professional** plans include **unlimited APIs and unlimited API calls** and the **Tyk Developer Portal**. **Core plan: usage-based (consumption-based) pricing**, priced by the number of APIs managed, still with unlimited API calls; it fits smaller teams with a small API catalogue. **Professional plan ("One price. Unlimited access."): architecture-based pricing**, priced by the number of data planes, environments and control-plane deployments, not by traffic; it fits enterprises with high or unpredictable traffic that need a predictable annual spend.

See also [deployment options and licensing](/docs/apim), [Tyk Hybrid](/docs/deployment-options/tyk-hybrid) and Tyk's [Tyk vs Kong](https://tyk.io/tyk-vs-kong/) overview.