Portkey alternative
A Portkey alternative built for self-serve
Portkey was acquired by Palo Alto Networks and folded into Prisma AIRS. That's a great outcome for Portkey, and a hard one for self-serve users, who are being routed toward an enterprise security suite with enterprise procurement to match. If you turned Portkey on with a credit card and a base-URL swap, that path is closing.
RemKey is built for exactly the developer PANW is structurally moving away from: the one who wants a security-grade gateway they can turn on in a minute, without a sales call. It carries the capabilities Portkey self-serve users relied on, routing, guardrails, a virtual key layer, and adds the parts a security team actually signs off on: a hash-chained, Ed25519-signed audit trail and fail-closed MCP tool-call governance.
The migration is not a rewrite. RemKey ships a config importer that translates your Portkey config into a RemKey policy, tells you exactly which provider keys you still need to connect, and grandfathers a free credit window so the switch costs you nothing while you validate it. You paste your old config; you get an upgrade report.
Portkey vs RemKey
| Capability | Portkey | RemKey |
|---|---|---|
| OpenAI/Anthropic-compatible base URL | ✓ Yes | ✓ Yes, accepts Bearer and x-api-key |
| Model routing | Config/rule-based routing | ✓ LLM classifier routing (96% acc. vs 33% keyword) |
| Guardrails (PII + injection) | Guardrails available | ✓ PII + Llama Guard, fail-closed, every request |
| Signed, tamper-evident audit trail | Logs / observability | ✓ Hash-chained + Ed25519-signed, verify offline |
| MCP tool-call governance | ✗ Not a first-class feature | ✓ Fail-closed allowlist, blocked calls logged |
| BYOK with instant revoke | Virtual keys (vault-bound) | ✓ BYOK, first-party preferred, instant revoke |
| Self-serve, no sales call | ✗ Moving enterprise (Prisma AIRS) | ✓ Turn on in 60 seconds |
| Migration importer + grandfathered credits | ✗ n/a | ✓ Translates your Portkey config, free window |
Comparison reflects the self-serve experience and public positioning. We credit what Portkey does well and only claim deltas that are real.
Who each is for
Choose Portkey if…
Enterprises already buying into the Palo Alto Networks / Prisma AIRS security platform, who want their LLM gateway inside that suite and have the procurement runway for it.
Choose RemKey if…
Developers and teams who ran Portkey self-serve and want to keep moving fast, a security-grade gateway they control, turned on in a minute, with their old config imported and credits grandfathered.
Migration is a translate step, not a rewrite. Paste your Portkey config into RemKey's importer. You get an upgrade report, the list of provider keys to connect, and a grandfathered free window so switching costs nothing while you validate.