FastRouter vs. Portkey

Strong product, new owner, different priorities.

Portkey ships a real, production-grade gateway: 1,600+ models, full MCP support, the broadest guardrail marketplace in the category (Patronus, Aporia, plus 60+ built-ins), prompt management with versioning, semantic caching, and an MIT-licensed open-source Gateway you can self-host. SOC 2 Type 2, ISO 27001, HIPAA, GDPR — the enterprise compliance shelf is filled in.

FastRouter matches Portkey on most gateway primitives — routing, governance, MCP, virtual keys, BYOK — and pulls ahead on the eval and optimization layer (Smart Evals, Automatic Evals, GEPA, video evals). The bigger differentiator now isn't features. It's that FastRouter remains an independent, developer-first roadmap, while Portkey's roadmap is being absorbed into Palo Alto Networks' Prisma AIRS security platform.

If you're a current Portkey customer who likes the product, nothing breaks tomorrow. If you're choosing for the next 12–24 months, the question is whether you want to bet on a security-platform integration or a standalone gateway product.

What the PAN deal actually changes

The Palo Alto Networks announcement frames the acquisition as bringing Portkey's "unified control plane for AI agents" into Prisma AIRS, PAN's enterprise AI security platform. The press release emphasizes agent governance, AI threat protection, and unifying AI security under PAN's existing enterprise sales motion.

That framing tells you what's about to get prioritized. Enterprise security buyers — CISOs, CISO orgs, compliance teams — are different customers than the AI engineering teams Portkey grew up serving. The product surface tends to bend toward the new buyer over the following 12–18 months. We've seen this pattern enough times in the AI/dev tools space that it's not speculation.

What that practically means:

• Pricing tends to migrate toward enterprise contract motion. Self-serve and small-team plans often quietly atrophy.
• Roadmap tilts toward the security buyer's priorities — agent risk classification, prompt-injection defenses, audit and reporting depth — and away from developer DX features (evals, prompt optimization, routing experimentation).
• Iteration speed usually slows as engineering teams integrate with the parent's systems (auth, billing, observability, security review).
• Open-source attention on the Portkey Gateway repo may diverge from cloud SaaS priorities.

None of this is a critique of PAN — it's a competent, well-run security business and Prisma AIRS is a real product. It's a change in fit for teams whose primary need is a developer-first, fast-iterating LLM gateway.

The four numbers most teams ask about.

1) Roadmap owner

FastRouter: Independent

Portkey: 5% markup

2) Routing strategies

FastRouter: 7 (incl. AI Auto)

Portkey: Fallback + conditional + LB

3) Built-in evaluations

FastRouter: Smart + Auto + GEPA + Video

Portkey: Batch evals + feedback API

4) Open-source gateway

FastRouter: Managed only

Portkey: Yes (MIT, self-host)

Feature matrix

Where the two products differ. ✓ supported, ✗ not supported, ◑ partial or paid-tier.

Both ship serious routing. The differences are at the edges.

Portkey's routing model is configuration-as-code. You define a Config — a JSON document declaring fallback chains, conditional routing rules (route on request metadata fields), and weighted load balancing — save it, and reference its Config ID in requests. Conditional routing is genuinely powerful: route Claude for "support_tickets" and GPT for "code_generation" by inspecting metadata at the edge. Fallbacks compose nesting, so you can build sophisticated multi-target failover trees.

FastRouter exposes the same primitives plus three that Portkey doesn't ship: category-based routing as a first-class strategy (rather than emulated via conditional rules), highest-throughput as an explicit optimization axis, and the AI Auto Model Router that picks per request from cost, latency, and quality signals fed by the eval layer.

On gateway primitives — caching, retries, timeouts, multimodal, MCP — both are mature. Portkey's semantic caching is gated to the Enterprise tier; FastRouter ships it across plans. Portkey's MCP support is broad and well-documented; FastRouter adds credential vaulting on top, which matters for agentic workloads where you don't want tools or MCP servers to ever see raw provider keys.

Portkey routes between providers using configs you write. FastRouter routes between providers and between models — using signals it gathers automatically.

Both ship evals. They optimize for different workflows.

Portkey's eval story is built around two primitives: a Feedback API for attaching scores (-10 to +10, optional weight) to traces by trace ID, and batch evaluations for offline reliability, grounding, and bias testing. The data feeds an evals dashboard alongside Analytics. It's a clean implementation that fits well into existing offline eval workflows.

FastRouter's eval story is built around continuous, on-traffic primitives: Smart Evaluations score live calls automatically, Automatic Evaluations sample real traffic to benchmark competing models in the background, and GEPA evolves prompt and model combinations toward Pareto-optimal cost/quality. Video evaluations extend this to a content type no other gateway in the category currently supports.

The practical difference is workflow. Portkey expects you to bring evaluation logic to it (datasets, scoring functions, feedback loops). FastRouter generates the signals continuously, then feeds them back into routing decisions. Both are valid; the question is whether you want evals as a tool you wield, or evals as a substrate that improves the gateway's behavior on its own.

Compliance shelves are similar. Threat-model emphasis differs.

On compliance certifications — SOC 2 Type 2, GDPR, HIPAA, ISO 27001 — Portkey and FastRouter are roughly at parity. Both ship workspace governance, virtual keys with budgets and rate limits, RBAC, SSO via Okta and Azure AD, and audit logs. Portkey's guardrail marketplace is broader: 60+ built-ins plus Patronus, Aporia, and integrations with Bedrock and Azure native guardrails. FastRouter ships built-in PII redaction and prompt-injection guardrails but a smaller third-party integration catalog.

Where the threat-model emphasis diverges: FastRouter's MCP credential vaulting was designed for agent workloads where the gateway is the only place that ever holds raw provider keys. Portkey's emerging emphasis under PAN/Prisma AIRS will tilt toward agent runtime threat protection, prompt injection defense, and security-buyer reporting. Both legitimate; different priorities.

How acquisitions usually play out in this category

The pattern that's typical when a fast-moving developer-tool company gets acquired by a larger enterprise platform vendor:

• Apr 30, 2026

PAN announces intent to acquire Portkey

Press release frames Portkey as the agent control plane inside Prisma AIRS. Existing customers continue to be supported.

• Now → close

Operations continue

Portkey's product surface unchanged for current customers. Roadmap announcements typically pause during the integration planning window.

• ~6 months post-close

Integration with parent's systems begins

Auth, billing, support, and security review get integrated. Iteration on standalone product features typically slows during this window.

• ~12 months post-close

Roadmap re-orients toward parent's buyer

Features tend to tilt toward security/compliance reporting and enterprise governance. Self-serve and small-team plans often atrophy. Developer DX investments slow.

• ~18–24 months post-close

Standalone product becomes a feature

Common outcome: the acquired product ships only as part of the parent's bundle. Sometimes the brand survives; the standalone roadmap usually doesn't.

When Portkey is the right call

You need the broadest guardrail integration catalog

• Patronus, Aporia, plus 60+ built-ins
• Bedrock and Azure native guardrails wired in
• Compliance teams have specific 3rd-party requirements

You want the MIT-licensed gateway as a fallback

• Open-source Gateway (~122KB) you can self-host if needed
• Optionality if cloud product changes post-acquisition
• Code visibility for security review

You're already a Palo Alto Networks customer

• Procurement, billing, and security review already in place
• Prisma AIRS bundle may make commercial sense
• Single vendor relationship for AI security stack

You need raw model breadth (1,600+)

• Largest managed-gateway catalog
• Niche/long-tail providers covered
• Easier to land on a single API for everything

When FastRouter is the right call

You're choosing for the next 12–24 months

• Independent, developer-first roadmap
• No integration window to wait through
• No bet on what Prisma AIRS becomes

You want continuous evals, not batch evals

• Smart + Automatic Evaluations on live traffic
• GEPA prompt optimization runs continuously
• Eval signals feed AI Auto routing decisions

You're running serious agentic workloads

• MCP credential vaulting — agents never see raw keys
• AI Auto Model Router selects per request
• Workspace-level budget kill-switches

You want video evaluations

• Compare model quality on video inputs
• No other gateway in the category supports this
• Useful for multimodal product workflows

Pick the right tool for your situation

1) IF -> You're currently on Portkey and the product is working

Stay for now. Re-evaluate in 6–12 months once PAN's roadmap signals get more concrete. Run a parallel FastRouter audit so you have a comparison when it's time.

2) IF -> You're choosing a gateway today for the next 12–24 months

Default to FastRouter. Independent roadmap, comparable feature parity, deeper eval and optimization layer. The 7-day audit will tell you what your routing efficiency looks like before you commit.

3) IF -> Your security org has specific 3rd-party guardrail requirements (Patronus, Aporia)

Use Portkey. The marketplace breadth is genuinely the deepest in the category.

4) IF -> You're already a Palo Alto Networks customer and want a single vendor

Talk to PAN about the Prisma AIRS bundle. Single procurement, single security review, single throat to choke.

5) IF -> You need an MIT-licensed self-hostable gateway as a fallback

Pin Portkey Gateway (the OSS repo) at a known-good version. Use it as a contingency. If you need both managed convenience and OSS optionality, the answer is "both" rather than "either."

Common questions

1) Does anything break for Portkey customers because of the acquisition?

No. PAN has stated existing customers continue to be supported and the deal closes in PAN's Q4 fiscal 2026. Day-to-day operations are unchanged. The risk is forward-looking — what gets built (or doesn't) over the next 12–24 months.

2) How hard is it to migrate from Portkey to FastRouter?

Both are OpenAI-compatible. The bulk of migration is endpoint and key changes. Portkey Configs (fallback, conditional routing) port to FastRouter strategies — usually a 1:1 mapping with category-based routing replacing some conditional rules. Virtual keys map to FastRouter API keys. We help with cutover for production workloads.

3) Is Portkey's open-source Gateway worth using on its own?

Yes — for what it does. The OSS Gateway (~122KB, MIT) is fast and solid. It's the gateway primitive only — observability, governance, prompt management, evals are cloud-only. If your need is "give me a fast multi-provider proxy I can self-host," the OSS Gateway alone may be enough. If you need governance and evals, you're back to comparing managed products.

4) What about Portkey's 1,600 model catalog?

It's real and it's broader than FastRouter's. If you specifically need a long-tail model that only one provider hosts, Portkey is more likely to have it on day one. For the top 30 models that drive ~95% of production traffic in 2026, both cover them.

5) What about Portkey's guardrail marketplace?

Genuinely broader than FastRouter's today. 60+ built-ins, plus Patronus AI (hallucination detection, RAG-specific), Aporia (data leak prevention, policies), and integrations with Bedrock and Azure native guardrails. If your security team has specific 3rd-party guardrail requirements, this is a real Portkey advantage.

6) Will FastRouter add similar guardrail integrations?

Yes — it's on the roadmap. We ship built-in PII redaction and prompt-injection guardrails today, and the third-party integration catalog is expanding. If a specific guardrail is a hard requirement, ask us — there's a good chance it's already shipped or close.

7) What about pricing post-acquisition?

Pre-acquisition Portkey published a Free tier (10K req/mo), Pro (usage-based), and Enterprise (custom). Post-acquisition pricing is something to watch — enterprise platform vendors often migrate self-serve plans toward enterprise contracts over 12–18 months. We don't have a confirmed change to point to today.