API gateways: Kong vs NGINX vs APIM — Cheat Sheet — Practical Guide (May 13, 2026)

API gateways: Kong vs NGINX vs APIM — Cheat Sheet

Level: Intermediate Software Engineer

Updated as of May 13, 2026 (Kong 3.x+, NGINX 1.26+, Azure API Management 2026-05)

Introduction

API gateways are crucial components in modern microservices and distributed architectures. They centralise request routing, security, observability, and traffic management, empowering scalable and manageable API ecosystems.

This concise guide compares three popular API gateway solutions—Kong, NGINX (Open Source and NGINX Plus), and Microsoft Azure API Management (APIM)—to help you choose the right fit for your project and operational environment.

Prerequisites

• Basic familiarity with REST or gRPC API concepts
• Experience deploying and managing containerised or VM-based applications on Linux or Windows
• Understanding of service mesh concepts and API security (OAuth 2.0, JWT, mTLS)
• Access to a cloud account (for Azure APIM) or server with Linux/macOS/Windows support (for Kong/NGINX)

API Gateways Overview

Kong

Kong is an open-source, high-performance API gateway built on NGINX and OpenResty, often deployed as a cloud-native solution. Kong 3.x+ supports declarative configuration, plugin extensibility, and advanced traffic control with minimal overhead.

NGINX

NGINX can operate as a basic reverse proxy API gateway (Open Source) or a fully featured API gateway with NGINX Plus, which includes built-in API management features such as JWT authentication, rate limiting, and a dynamic configuration API.

Azure API Management (APIM)

APIM is a managed cloud service designed for Azure-hosted or hybrid API ecosystems. It delivers integrated developer portals, security, analytics, versioning, and lifecycle management, ideal for enterprises reliant on Microsoft Azure infrastructure.

Hands-on Steps: Basic Configuration Examples

Kong — Enabling JWT Authentication Plugin

The following example shows how to enable the JWT authentication plugin for a service in Kong, via the Admin API (Kong 3.x+):

curl -i -X POST http://localhost:8001/services 
  --data name=example-service 
  --data url=http://mockbin.org/request

curl -i -X POST http://localhost:8001/services/example-service/routes 
  --data 'paths[]=/example'

curl -i -X POST http://localhost:8001/services/example-service/plugins 
  --data name=jwt

NGINX Open Source — Configuring Basic Proxy with Rate Limiting

This minimal example uses the limit_req_zone and limit_req modules for rate limiting in NGINX (1.26+):

http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s;

    server {
        listen 80;

        location /api/ {
            limit_req zone=one burst=20 nodelay;
            proxy_pass http://backend_api;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}

Azure API Management — Basic Inbound Policy to Check JWT

In Azure APIM’s policy XML format, you can add a JWT validation policy on inbound requests:

<policies>
  <inbound>
    <base/>
    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
      <openid-config url="https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration" />
      <required-claims>
        <claim name="aud">
          <value>your-api-audience</value>
        </claim>
      </required-claims>
    </validate-jwt>
  </inbound>
  <outbound>
    <base/>
  </outbound>
  <on-error>
    <base/>
  </on-error>
</policies>

Common Pitfalls

• Kong: Be mindful of plugin ordering and dependencies; plugins like rate-limiting require correct upstream keys and consistent data store configuration (PostgreSQL or Cassandra).
• NGINX Open Source: Does not provide built-in API key or JWT validation; additional modules or external tooling are required for advanced authentication features.
• NGINX Plus: Features like dynamic reconfiguration and JWT support require a commercial license. Lack of familiarity with the configuration syntax may complicate setup.
• Azure APIM: The developer portal and policy XML can be overwhelming; test policies incrementally. Network latency and throughput are bound by Azure region and SKU.
• All tools require monitoring and resource allocation to avoid bottlenecks; gateway horizontal scaling strategies should be planned early.

Validation

Validate your gateway setup through the following steps:

1. Send test API requests with valid and invalid JWTs or API keys, verify response codes (200 vs 401/403).
2. Perform load testing within documented limits to assess rate limiting and burst tolerance without packet loss.
3. Inspect gateway logs and metrics for errors and traffic patterns.
4. Use gateway-specific CLI or dashboard tools (e.g. Kong Manager, NGINX Plus dashboard, Azure Portal monitoring).

Checklist / TL;DR

• Use Kong if you want a highly extensible, cloud-native API gateway with a strong plugin ecosystem and support for hybrid deployments.
• Choose NGINX Open Source for simple reverse proxy API gateway needs with lightweight traffic control, if you don’t require advanced API management.
• Pick NGINX Plus when you need enterprise API features, JWT validation, dynamic configuration, and enterprise support but want to manage your own infrastructure.
• Opt for Azure API Management when you seek a fully managed, scalable cloud API gateway integrated with Azure services and developer experience.
• Secure your gateway: implement authentication (JWT, OAuth 2.0), rate limiting, and logging.
• Plan for scalability: container orchestration, clustering (where supported), or cloud autoscaling.
• Continuously validate with real traffic, monitor for anomalies, and automate deployments using Infrastructure-as-Code.

When to choose Kong vs NGINX vs APIM

Kong is ideal if you want fast deployment with operable plugins, a strong open-source community, and hybrid cloud flexibility. It is well suited to organisations that value extensibility without vendor lock-in.

NGINX (Open Source)</strong fits when you need a simple, reliable reverse proxy or basic gateway functionality without licensing costs, but don’t require integrated API management features. NGINX Plus</strong fills the gap if you want commercial-grade API management and enterprise support.