LiteLLM vs OpenRouter vs Portkey: Pick the Wrong One

Contents

Figure 1: LiteLLM vs OpenRouter vs Portkey: Pick the Wrong One — three gateways, three very different bills

You want one API in front of every model, plus fallbacks, spend limits and logs. Three names keep showing up: LiteLLM, OpenRouter and Portkey. They solve the same headline problem in very different ways, and the wrong pick costs you either money or weekends.

This guide compares them on hosting, cost, features and risk. Prices and ownership changed this year, so I checked the current vendor pages, press releases and repository history, and I flag anything I could not confirm. Ready to pick a gateway?

The Short Answer

If this is your constraint	Pick	Because
You want one account, one key and nothing to run	OpenRouter	A hosted catalog of hundreds of models with no infrastructure and no deploy
Traffic and provider keys must stay in your network	LiteLLM	Self-hosted, open-source core, virtual keys and per-team budgets you control
Observability, guardrails and governance matter most	Portkey	Tracing, guardrails and prompt management in one product, with a hosted control plane

Now the details, because each one has a catch.

What Each Gateway Actually Is

LiteLLM: The Self-Hosted Proxy

LiteLLM is an open-source Python SDK and proxy server that you run yourself. It speaks the OpenAI format and routes to 100+ providers [1]. The repository is MIT-licensed except for the enterprise/ directory, which carries its own commercial license [1]. The proxy ships virtual keys, budgets, rate limits, load balancing, fallbacks and an Admin UI, and the docs put SSO/SAML, audit logs and some governance features behind the paid Enterprise tier [1].

You pay nothing for the software and you pay in operations. You run the servers, the Postgres database, the upgrades and the security work.

That last item became real on March 24, 2026, when two PyPI releases — litellm 1.82.7 and 1.82.8 — went out with credential-harvesting malware after a CI/CD token was exposed through a compromised Trivy dependency [2]. PyPI quarantined them the same day, the official Docker images were unaffected because they pin dependencies, and a clean v1.83.0 shipped through a rebuilt pipeline [2]. Pin your versions and read the advisory if you install from PyPI [2].

OpenRouter: The Hosted Marketplace

OpenRouter is a hosted service. You sign up, buy credits and call hundreds of models through one key. Its pricing page lists 500+ models and 80+ providers on the Standard plan, which are its own numbers, and you cannot self-host it [3].

The pricing model is the part that matters. OpenRouter says it passes provider prices through with no markup on inference, and it charges its fee when you buy credits rather than per request [3].

Plan	Fee on credit purchases	Notes
Free	N/A	25+ free models, 4 free providers, 50 requests/day
Standard	5.5%	500+ models, 80+ providers, pay-as-you-go
Business	8%	Same catalog, higher platform fee
Enterprise	Fee discounts available	Contractual SLAs, SSO/SAML, managed policy enforcement

I could not confirm a $0.80 minimum charge on credit purchases in the current pricing or FAQ pages, so do not plan around it [3]. Small top-ups are still a bad idea, because a percentage fee on a small purchase buys very little inference.

Portkey: The Governance-First Gateway

Portkey pairs an MIT-licensed open-source gateway with a hosted control plane. The gateway handles routing, retries, fallbacks, load balancing and guardrail checks, and the hosted platform adds stored logs, analytics, prompt management and governance [4].

Pricing starts with a free Developer plan and a $49 per month Production plan [4]:

Plan	Price	Recorded logs	What you get
Developer	Free	10k/month, 3-day log retention	Prototyping only, per the page's own wording
Production	$49/month	100k/month, then +$9 per extra 100k	Guardrails, prompt management, RBAC basics
Enterprise	Custom	Custom retention	RBAC, SSO, granular budgets, VPC hosting, SOC2/GDPR/HIPAA

Exceeding the log limit does not block requests; the extra logs simply are not recorded [4]. That is a quiet failure mode: your dashboards thin out exactly when traffic spikes.

One fact changes the calculus. Palo Alto Networks announced its intent to acquire Portkey on April 30, 2026 and closed the deal on May 29, 2026 [5]. Portkey is now the AI gateway inside Prisma AIRS, and Palo Alto said it will keep supporting existing and new customers [5].

The open-source side looks quiet. The gateway repository's last tagged release is v1.15.2 from January 12, 2026, and the repository's last push was May 25, 2026 [5]. Treat the open-source roadmap as uncertain until the new owner publishes one.

Side-by-Side Comparison

Dimension	LiteLLM	OpenRouter	Portkey
Hosting	Self-host	Hosted only	OSS gateway self-host, plus hosted platform
License	MIT core, commercial enterprise/	Closed source	MIT gateway, closed hosted platform
Provider reach	100+ providers [1]	500+ models, 80+ providers [3]	Large catalog, vendor-reported
Cost model	Free software, you pay infrastructure	5.5% Standard / 8% Business on credit purchases [3]	Free OSS, hosted from $49/month [4]
Budgets and virtual keys	Strong, needs a database	Per-key limits, plan-dependent	Granular budgets in Enterprise [4]
Observability	Spend logs, callbacks to your own tools	Activity logs and export	A core strength: logs, traces, feedback [4]
Guardrails	Available as a feature	Not a focus	Built in, LLM and partner guardrails [4]
Data stays in your network	Yes	No	Yes with self-host or Enterprise VPC [4]
Ownership risk	Open source, one vendor's enterprise tier	Private company	Owned by Palo Alto since May 2026 [5]

Treat the provider and model counts as marketing numbers. Each vendor counts differently and the totals move monthly.

The Real Cost Math

Cost depends on how you buy. Here is a rough example for a team spending $10,000 a month on model usage.

Option	Monthly gateway cost	What that buys
OpenRouter, credit purchases	About $550 at the 5.5% Standard fee	One key, one catalog, no infrastructure
OpenRouter, BYOK	$0 up to $25,000 of list-price inference, then 5% [3]	Your own provider accounts, their rate limits
LiteLLM	$0 in licence fees, plus servers, database and engineering time	Full control, full operational ownership
Portkey Production	$49 plus $9 per 100k logs beyond the first 100k [4]	Traces, guardrails, prompt management

The OpenRouter BYOK allowance is the number most comparison posts get wrong. The FAQ and the pricing page now agree: the allowance is measured by list-price inference cost, not request count, at $25,000 per month on pay-as-you-go, with Enterprise allowances custom [3]. Usage above it costs 5% of what the same model and provider would have cost on OpenRouter, deducted from your credits [3].

Portkey's fee scales with recorded logs, not spend. 100,000 logs a month is roughly 3,300 requests a day, which a busy application outgrows quickly [4]. A $10,000-a-month spender with a chatty frontend can pay more in log overage than a $550 credit fee.

The cheapest option on paper rarely stays cheapest after you count engineering hours. Price your own time too: a gateway with no owner is a pager waiting to happen.

When to Choose Each One

Choose OpenRouter If You...

• Want to test many models this afternoon without managing any infrastructure.
• Prefer a single bill and a single key for experiments and side projects.
• Value breadth of catalog over deep governance.

The trade-offs: you cannot self-host, your traffic passes through a third party, and the free and Standard tiers carry no contractual SLA — that appears on Enterprise only [3].

Choose LiteLLM If You...

• Need traffic and provider keys to stay inside your own network.
• Want per-team budgets, virtual keys and load balancing you control.
• Have the engineering capacity to run a service and patch it quickly.

The trade-offs: you own uptime, upgrades and security, and SSO/SAML, audit logs and some governance features need the Enterprise licence [1]. Start with the proxy server guide and the virtual keys and budgets guide before you plan the rollout.

Choose Portkey If You...

• Care most about tracing, guardrails, prompt management and governance in one product.
• Already use, or plan to use, Palo Alto Networks security tools.
• Accept that the product's direction now depends on its new owner.

The trade-offs: hosted plans meter by logs, several governance features sit in the Enterprise tier, and the open-source side has had no tagged release since January 2026 [4][5].

Can You Use Them Together?

Yes, and many teams do. A common pattern puts a self-hosted gateway in front of your applications and lists a hosted aggregator as one of its upstream providers. That gives you internal budgets and keys while the aggregator supplies long-tail models you do not want to integrate yourself.

The trade-off is two failure domains. A hosted upstream outage becomes a fallback event inside your own gateway, which is exactly what the fallback configuration is for. Check each tool's docs for current provider support before you rely on the combination.

If you go that route, the self-hosted hop needs the tuning most teams skip — see the load balancing guide and the HTTP timeouts and connection tuning guide.

Questions to Ask Before You Commit

1. Where must prompts and keys live? Strict data rules usually point to self-hosting.
2. Who will run it? A gateway without an owner becomes a liability.
3. How much do you spend, and on what? Percentage fees hurt more as volume grows; log-metered fees hurt more as traffic grows.
4. What do you need to see? Logs, traces and guardrails push toward Portkey; plain spend control fits LiteLLM.
5. How much vendor risk can you accept? Acquisitions and open-source maintenance both matter.
6. Can you leave? All three speak OpenAI-style APIs, so switching stays feasible if you keep your own model aliases.

That last point deserves extra weight. Put your own alias layer in your code or config, and a gateway change becomes a weekend project rather than a rewrite.

Run a One-Week Bake-Off

Opinions fade and data sticks. Test your two finalists with real traffic.

Day	Task
1	Set up each gateway with the same two providers
2–4	Send a copy of real, non-sensitive requests through both
5	Compare latency, error rates and behaviour during a simulated provider outage
6	Check cost reports against actual provider invoices
7	Ask each person who touched it what annoyed them

Note how each gateway handles failure. A gateway that works on sunny days tells you very little.

Common Pitfalls

1. Choosing on feature lists alone. Operations, ownership and pricing shape your daily life more.
2. Ignoring the credit fee. Small percentages add up at scale, and small top-ups waste most of the purchase on fees.
3. Reading a stale fee page. OpenRouter's BYOK allowance changed shape, and older posts still quote request counts [3].
4. Running LiteLLM unpinned and unpatched. The March 2026 PyPI incident showed the cost [2].
5. Assuming open source means safe forever. Check release dates and maintainer activity: Portkey's last tagged release was January 2026 [5].
6. Metering logs on the cheap plan. Portkey's free tier keeps three days of logs and stops recording past 10k a month [4].
7. Skipping a fallback plan for the gateway itself. A gateway outage then becomes your outage.

Wrapping Up

The three gateways serve different needs. OpenRouter gives you instant access with zero operations, LiteLLM gives you control inside your own infrastructure, and Portkey gives you governance and observability under a new owner.

Pick based on your binding constraint: hosting, cost or visibility. Then write down your top three requirements, pick two finalists and run the one-week bake-off.

The right gateway usually becomes obvious by Friday, and you will know exactly why you picked it.

If you go the self-hosted route, the Docker production guide covers the container, keys and probes you need on day one.

Frequently Asked Questions

Which LLM gateway is best for a small team?

For a small team that wants one key and no infrastructure, OpenRouter is the fastest path: you buy credits and call hundreds of models immediately. A small team with strict data rules or per-team budgets should self-host LiteLLM instead, because the software is free and the only cost is the server you already run. Portkey makes sense when tracing and guardrails are the main requirement, not the cost of running anything.

Is LiteLLM really free?

The software is free: the repository is MIT-licensed except for the enterprise/ directory, which carries its own commercial license. You pay in operations instead, meaning servers, a Postgres database, upgrades and the security work of patching quickly. Some advanced features such as SSO/SAML, audit logs and parts of governance sit behind the paid Enterprise license.

How much does OpenRouter charge?

OpenRouter says it passes provider prices through with no markup on inference. Its fee is charged when you buy credits: 5.5% on the Standard plan and 8% on the Business plan, with fee discounts on Enterprise. Using your own provider keys (BYOK) is free up to $25,000 of monthly list-price inference on pay-as-you-go, then 5% of what the same usage would have cost on OpenRouter.

What happened to Portkey after the Palo Alto Networks acquisition?

Palo Alto Networks announced its intent to acquire Portkey on April 30, 2026 and closed the deal on May 29, 2026. Portkey becomes the AI gateway inside Prisma AIRS, and Palo Alto said it will keep supporting existing and new customers. The open-source gateway's last tagged release was v1.15.2 on January 12, 2026, with the repository last pushed on May 25, 2026, so treat the open-source roadmap as uncertain until the new owner publishes one.

Can I run LiteLLM and OpenRouter together?

Yes. A common pattern puts a self-hosted gateway such as LiteLLM in front of your applications and lists a hosted aggregator such as OpenRouter as one of its upstream providers. You keep internal virtual keys, budgets and logs, while the aggregator supplies long-tail models you do not want to integrate yourself. Check current provider support in each tool's docs before you depend on the combination.

What was the LiteLLM PyPI incident in March 2026?

Two releases, litellm 1.82.7 and 1.82.8, were published to PyPI on March 24, 2026 containing credential-harvesting malware after a CI/CD token was exposed through a compromised Trivy dependency. PyPI quarantined them the same day, official Docker images were unaffected because they pin dependencies, and LiteLLM shipped a clean v1.83.0 through a rebuilt pipeline. If you install from PyPI, pin versions and watch advisories.

Sources

• [1] LiteLLM, repository license and Enterprise scope — the LICENSE file stating that everything outside the enterprise/ directory is MIT, the docs banner listing SSO/SAML, audit logs, spend tracking and multi-team management as Enterprise, and the "call 100+ LLMs" provider reach: github.com/BerriAI/litellm/blob/main/LICENSE and docs.litellm.ai
• [2] LiteLLM, Security update: suspected supply chain incident (March 24, 2026) — litellm 1.82.7 and 1.82.8 published at 10:39 UTC and quarantined by PyPI the same day, the compromised Trivy dependency as the suspected origin, official Docker images unaffected because dependencies are pinned, and the clean v1.83.0 release through a rebuilt pipeline; with the matching advisory GHSA-5mg7-485q-xm76 / PYSEC-2026-2: docs.litellm.ai/blog/security-update-march-2026 and github.com/advisories/GHSA-5mg7-485q-xm76
• [3] OpenRouter, pricing and FAQ — no markup on inference, the fee charged on credit purchases at 5.5% on Standard and 8% on Business with Enterprise discounts, the BYOK free allowance of $25,000 of list-price inference per month on pay-as-you-go with a 5% fee above it, 500+ models and 80+ providers on Standard, 25+ free models and 50 requests/day on Free, and contractual SLAs limited to Enterprise: openrouter.ai/pricing and openrouter.ai/docs/faq
• [4] Portkey, pricing — the free Developer plan with 10k recorded logs per month and 3-day log retention, the $49/month Production plan with 100k recorded logs and +$9 per additional 100k, the note that exceeding the limit only stops logging rather than blocking requests, and Enterprise-only RBAC, SSO, granular budgets, VPC hosting and SOC2/GDPR/HIPAA: portkey.ai/pricing
• [5] Palo Alto Networks, Portkey acquisition — the April 30, 2026 announcement of intent with Portkey as the AI gateway for Prisma AIRS and continued support for existing and new customers, the May 29, 2026 completion release; plus the Portkey gateway repository's release history, where the last tag is v1.15.2 dated January 12, 2026, and its last push on May 25, 2026: paloaltonetworks.com press release, April 30, 2026 and paloaltonetworks.com press release, May 29, 2026

Related Articles

• LiteLLM Timeouts: The Setting Your Load Balancer Kills
• LiteLLM Load Balancing: Your RPM Limit Is a Suggestion
• LiteLLM in Docker: The Salt Key You Can Never Change
• LiteLLM Virtual Keys and Budgets: The Bill Nobody Watches