--- title: "Kong AI Gateway alternative — for coding tools · Selan" description: "Kong AI Gateway puts Claude Code behind your identity provider, on a data plane you run. Selan is hosted, one sign-in per person. Where each fits." url: https://selan.ai/compare/kong-ai-gateway updated: 2026-11-07T11:08:22+02:00 --- Compare · Kong AI Gateway and Selan # Is there a Kong AI Gateway alternative for a team's Claude Code? Yes, if the traffic is your team's coding tools and nobody wants to run a gateway. Kong AI Gateway is Kong's gateway for model, MCP and agent traffic. Kong runs its control plane in Konnect, and the data plane that carries requests runs on your machines or on Kong's. Claude Code reaches it with a token from your identity provider. Selan is a hosted gateway that each developer signs in to once. If your company already runs Kong for its APIs, Kong AI Gateway is the better answer. ## How do Kong AI Gateway and Selan compare? | | Kong AI Gateway | Selan | | --- | --- | --- | | What it is | A gateway for model, MCP and agent-to-agent traffic, with policies for sign-in, guardrails, transformations and rate limits | A hosted gateway, with a CLI that launches Claude Code, Codex and OpenCode through it | | Where it runs | A control plane in Kong Konnect and data plane nodes you run (Docker, a VM or Kubernetes), or serverless and dedicated cloud gateways that Kong hosts | A hosted service, built and hosted in the EU. Nothing to run | | Coding tools | Setup pages for Claude Code, Codex CLI and Qwen Code CLI; Kong's Claude walkthrough also connects Claude Desktop | Claude Code, Codex, OpenCode and Claude Desktop | | Claude for Claude Code | An Anthropic API key kept in the gateway's vault, or Amazon Bedrock, Azure AI Foundry or Google Vertex AI | The Claude and ChatGPT accounts and API keys your company connects | | A developer's credential | A token from your identity provider, fetched by a helper script in `apiKeyHelper`, or an API key | One sign-in with Google or Microsoft through `selan login` | | Usage per person | A Konnect Analytics dashboard of cost, tokens and requests by model and consumer | One usage record per person, across every tool | | Limits | Token or dollar budgets per consumer or group over a time window, through a paid policy | A spend limit per person, by day, week or month in UTC, on pay-per-use keys | | Secrets | A paid PII sanitizer, through a PII service that runs in a Docker container | Secret scanning replaces a secret it recognises before the request leaves | | Cost | From $25 a month plus usage; a hybrid control plane is $200 a month | Free for up to three seats, no card | Kong AI Gateway adds AI traffic to the API platform a company already runs. Selan is a gateway a team signs in to for its coding tools. ## When is Kong AI Gateway the better answer? When your platform team already runs Kong for its APIs. The same control plane then governs model, MCP and agent-to-agent traffic with the policies you already use. The data plane runs where you put it: a laptop, your VPC or Kubernetes. Kong also sells fully self-hosted gateways, control plane included, as part of Gateway Enterprise. It signs developers in through any OpenID Connect provider, such as Okta or Entra ID. A group claim in the token can pick which models a person may reach, and which budget they count against. It reaches Claude on Anthropic, Amazon Bedrock, Azure AI Foundry and Google Vertex AI. Its setup pages also put OpenAI, Gemini, Alibaba Cloud and Hugging Face models behind Claude Code. If no team runs coding tools through a gateway, you do not need Selan. ## How does Kong AI Gateway tell developers apart? By the token from your identity provider. Claude Code cannot run an OpenID Connect sign-in itself, so Kong's recipe gives it a helper script in `apiKeyHelper`. The script opens the browser for sign-in, caches the token and refreshes it. The gateway checks the token and maps its group claim to a consumer group. Each group can have its own models and its own token or dollar budget. No provider key sits on the laptop. Kong's walkthrough sets `ANTHROPIC_BASE_URL`, the identity provider's values and the model names in `~/.claude/settings.json`. It also sets `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`, which strips beta fields only Anthropic's own API accepts. An `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the shell bypasses the helper, so it has to be unset. **Good to know:** budget counters are kept on each data plane node by default. With more than one node, a shared budget needs Redis. Kong's docs say the data-store option does not work in hybrid mode or on Konnect. ## What does Kong AI Gateway cost? Kong's Plus plan starts at $25 a month plus usage, with a 30-day trial that needs no card. A serverless control plane is $25 a month, a hybrid one $200 a month, and a dedicated cloud gateway $500 a month plus $0.15 per GB. Plus includes one million requests a month, then $200 for each further million, up to ten million. Each distinct model the gateway proxies costs $100 a month, up to five on Plus. The budget policy, the PII sanitizer and the semantic cache are paid plugins: an add-on on Plus, included in Enterprise. A fully self-hosted gateway is priced by Kong's sales team. **Good to know:** Kong's AI CLI docs list two limits. Load balancing and failover work only if all providers share the same model identifier. Streaming is not supported for non-Claude models on Azure OpenAI, Gemini and Bedrock, and token usage may then show as 0. ## When is Selan the better answer? When the traffic is a team's coding tools and nobody wants to run a data plane or an identity helper. A developer runs `selan login` once, then `selan claude`, `selan codex` or `selan opencode`. Claude Desktop goes through the same gateway with one settings file. Claude Code, Codex, OpenCode and Claude Desktop go into one usage record per person, with no consumer groups to map. A limit per person applies across every pay-per-use key. An owner connects the company's accounts and keys once, and switches on the models the team may use. No provider key reaches a laptop. With secret scanning on, a secret it recognises is replaced before the request leaves. The trade-off is that requests travel through Selan, so if Selan is unavailable those requests fail. Your accounts can still be used directly. Which providers serve which models is in [models and providers](https://selan.ai/docs/providers), limits per person are on [the spend page](https://selan.ai/solutions/spend), and scanning is in [the secret scanning docs](https://selan.ai/docs/secrets). ## How do you move Claude Code from Kong AI Gateway to Selan? Kong's setup script merges an `apiKeyHelper` line and an `env` block into `~/.claude/settings.json`, and keeps your old file as `settings.json.bak`. Restore that backup, or remove the helper line, `ANTHROPIC_BASE_URL`, the identity provider's values, the model names and `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`. Delete the cached token in `~/.claude/okta-cache`. Then run `selan login` and `selan claude`. Connect the same Anthropic or Vertex accounts in Selan and switch on their models. You can keep Kong for your own apps and run the team's coding tools through Selan. Keeping provider keys off laptops is covered in [Claude Code without API keys on laptops](https://selan.ai/guides/claude-code-without-api-keys), and the kinds of gateway in [Claude Code gateways](https://selan.ai/guides/claude-code-gateway). [Start for free](https://auth.selan.ai/r) Free for up to three seats, and the Free plan needs no card. ### The short version - Kong AI Gateway adds model, MCP and agent traffic to Kong: Kong runs the control plane, and you run the data plane or buy a hosted one. - Claude Code reaches it with a token from your identity provider, fetched by a helper script. - Budgets per group and the PII sanitizer are paid plugins; Plus starts at $25 a month plus usage. - Selan is hosted in the EU: one sign-in per person, no provider key on the laptop, and a spend limit per person. What Kong AI Gateway does is as Kong's documentation (the AI gateway overview, AI CLI tools, the Claude Code SSO cookbook, the AI Rate Limiting Advanced policy and the AI PII Sanitizer plugin), its pricing page and its kong-claude-ai-gateway repository (commit 141c812) described it, read on 5 November 2026. It changes: check the date before relying on it. What Selan does is as its CLI and docs stated it on that date.