Is Portkey the same as the PRISMA AIRS AI Gateway?

According to the vendor homepage, Portkey is now the PRISMA AIRS AI Gateway. Palo Alto Networks states in its own press release that the acquisition closed on May 29, 2026, and general availability was announced on July 16, 2026. As of September 26, 2026, the open-source repository and the documentation still carry the Portkey name.

Does Portkey measure the working time of coding agents?

According to the documentation reviewed (as of September 26, 2026), Portkey measures the requests that pass through the gateway, for example from Claude Code or Codex. A local companion that captures agent time, LLM time and the use of subscriptions such as Claude Max is not described there. The innFactory AI Gateway ships such a companion.

When is the innFactory AI Gateway the better fit?

When gateway, dashboard and cost data must run entirely in your own Azure, STACKIT or Kubernetes tenant, budgets are managed in euros via cost centers, SSO and roles must be included in every license tier, or the agent time of Claude Code, Codex and OpenCode should be measured per project.

Portkey Alternative: AI Gateway in Your Own Tenant

Key facts (as of 26 September 2026):
Portkey is, per the vendor homepage, now the PRISMA AIRS AI Gateway of Palo Alto Networks; the gateway repository is MIT-licensed according to the vendor, the pricing page lists the tiers Open Source (Host it Yourself), Developer, Production and Enterprise, and the documented deployment modes are Hosted/SaaS, Self-hosted and Hybrid.
The innFactory AI Gateway is deployed into the customer’s cloud tenant and bundles cost centers with per-member caps, budgets in euros and a companion that measures the agent time of Claude Code, Codex and OpenCode per repository, including subscription usage.
Per the enterprise documentation, Portkey’s hybrid mode runs the gateway engine in the customer VPC while the vendor hosts the web dashboard, routing configurations and aggregated metrics; with the innFactory AI Gateway, gateway, dashboard and all data run in the customer tenant, and a local companion for agent time is not described in the Portkey documentation (as of 26 September 2026).
Portkey fits when you need a very large number of models through one API, SAML, SCIM or LDAP, and dashboard and aggregated metrics may live at the vendor; the innFactory AI Gateway fits when gateway, dashboard and cost data must run entirely in your own tenant, budgets are managed in euros via cost centers and agent time is to be measured per repository.

Portkey calls itself the “Production Stack for Gen AI Builders” on its homepage and announces there that Portkey is now the PRISMA AIRS AI Gateway. Behind it stands Palo Alto Networks: per its own press release, the acquisition closed on May 29, 2026, and the gateway became generally available as PRISMA AIRS AI Gateway on July 16, 2026. Repository, npm package and documentation are still named Portkey, so we use both names.

Portkey is a strong product. The gateway is published under the MIT license, the vendor states that it reaches more than 1,600 language models through one API, and it adds a dedicated MCP Gateway and a documented hybrid deployment in which the gateway engine runs in your own cloud.

The real decision lies elsewhere: where the control plane runs, how budgets are managed, which governance features depend on which tier, and what is actually measured for coding agents.

What Portkey (PRISMA AIRS AI Gateway) is

Portkey, Inc., based in San Francisco according to the footer of the vendor homepage, builds an AI gateway with routing, guardrails and observability. The GitHub repository describes routing to “1,600+ LLMs” with “50+ AI Guardrails”; the license file names the MIT license.

The pricing page separates what is open source from what is not: an “Open Source (Host it Yourself)” tier sits alongside Developer, Production and Enterprise. The repository covers routing with fallback and retry; dashboard, analytics and enterprise governance are a separate offering on top.

On ownership: in September 2025, Portkey still described Prisma AIRS as an integrated guardrail partner; the acquisition came in May 2026 according to Palo Alto Networks, and since then the gateway is “the core AI Gateway for Prisma AIRS”.

Deployment model: SaaS, self-hosting or infrastructure in your own tenant

The Portkey documentation names three modes: “Hosted/SaaS” through the vendor cloud service, “Self-hosted” via npx @portkey-ai/gateway, and “Hybrid”, where the self-hosted gateway is connected to Portkey. For enterprises the hybrid mode is the interesting case, and the documentation is precise about what runs where.

In the customer VPC, according to the vendor, run the gateway engine (“routes traffic across LLM providers and implements metering, access control, and guardrails”), a cache store and a data store for request and response logs. At the vendor runs the control plane: it “hosts the web dashboard for managing configurations, tracking analytics, and viewing logs” and maintains routing configurations and aggregated metrics. The data statement reads: “All prompt content and LLM responses remain within your network”; only anonymized metrics cross the network boundary. We did not find an EU-specific region for the SaaS mode on the pages reviewed.

The innFactory AI Gateway goes one step further: there is no control plane at our end. Gateway, dashboard, database and all cost data are rolled out as a cloud-native infrastructure component into the customer tenant, on Azure Container Apps or AKS, STACKIT or any Kubernetes. The gateway is a Rust binary in a container plus a dashboard image, with PostgreSQL, MongoDB or Azure Cosmos DB as the database. innFactory hosts nothing as SaaS; innFactory GmbH, a Microsoft CSP, supports the rollout and can provide the Azure subscription. Configuration lives as YAML under version control, plus a Terraform provider.

Identity, SSO and roles

Portkey documents SSO with Okta and Azure AD, each via OIDC and SAML 2.0, plus generic OIDC/SAML, along with SCIM provisioning for Okta and an LDAP bridge. That is a broad identity offering. On tier mapping: the SSO documentation states no tier restriction; on the pricing page, as we read it (as of September 26, 2026), SSO is listed under Enterprise, while Production lists Role-Based Access Control and Service Account API Keys. The current pricing page prevails.

With the innFactory AI Gateway, identity is included in every license tier: Microsoft Entra ID or generic OIDC (Keycloak documented, AWS Cognito claims handled). There are seven roles: Owner, Admin, Auditor, Finance, Security, Member and Guest; guests are assigned automatically for logins from outside the allowed e-mail domains and receive no proxy access. SAML and SCIM are currently not included; anyone who needs them finds them at Portkey.

Cost control and AI FinOps

According to the documentation, Portkey sets budgets per API key, per workspace and per provider integration. A reached limit, per the vendor, lets the key expire automatically, and alert thresholds warn beforehand. Periods: “No Periodic Reset”, “Reset Weekly” (Sunday 12 AM UTC) and “Reset Monthly” (1st calendar day, 12 AM UTC). The currency is USD (“Set a budget limit in USD”). Attribution works through workspaces and custom metadata on requests. We did not find the term cost center on the pages reviewed, nor a CSV or API export of spend.

The innFactory AI Gateway is built around cost centers. Four independent gates: organization (monthly), cost center (monthly plus daily and weekly windows, as a pool or per user with caps per member), user and API key. Each exhausted gate answers with HTTP 402 and error code E4006; optionally a budget fallback model kicks in, while per-member caps remain hard stops. Prices come from ai-prices.eu and are applied after admin review; display is in euros at the ECB daily rate. Every buffered response carries the x-aigateway-response-cost header. Insights and the CSV export break spend down by model, user, repository, cost center and tool, including agent and LLM time.

Coding agents, subscriptions and agent time

Portkey’s Claude Code guide is well made. It keeps, per the vendor, “the same Anthropic-style settings.json structure” and switches the provider through the x-portkey-provider header; platform teams are meant to roll out Claude Code “without handing out raw API keys or losing visibility into usage”. There are variants for Anthropic, Vertex AI and Bedrock, a Codex guide, guides for Cline, Claude Desktop and the Claude Agent SDK. For OpenCode, Cursor, GitHub Copilot or Gemini CLI we found no dedicated guides on the integrations overview.

What is measured is what passes through the gateway. According to the Portkey documentation (as of September 26, 2026), a local companion that captures agent time or subscription usage is not described; we also found no material on an MDM or Intune rollout.

The innFactory AI Gateway offers both. There are proxy setups for six tools (Claude Code, Codex, OpenCode, Cowork, VS Code Continue, VS Code Copilot), each with its own key and cost center. aigw run claude|codex|opencode launches the tool with a short-lived proxy token without touching the tool configuration. The aigw companion runs as a small background service on Linux, macOS and Windows, reads the local session logs of Claude Code, Codex and OpenCode and reports agent time, LLM time and token classes per repository, user, tool and cost center. It detects whether a session ran through the gateway or on the tool’s subscription (Claude Max, ChatGPT/Codex plan); subscription usage is valued at list price but never billed, budgeted or rate-limited. Rollout works via device-code login or enrollment tokens through Intune, a macOS policy or a Linux script.

Providers, dialects and models

In breadth, Portkey is clearly ahead: “1,600+ LLMs via a unified API”, and the provider list in the documentation counts more than 50 vendors. Mistral AI is included; we did not find STACKIT, IONOS or Aleph Alpha in the list. The primary API surface is, per the documentation, the OpenAI-compatible signature, plus vision, audio and image generation. How Anthropic, Gemini or Responses requests are handled internally is not described in detail on the pages reviewed.

The innFactory AI Gateway knows 13 provider types: OpenAI, Azure OpenAI, Azure AI Foundry, Anthropic (direct or Vertex), Gemini (AI Studio or Vertex including the EU endpoint), Mistral, AWS Bedrock including Bedrock Mantle, STACKIT, IONOS, Ollama, LM Studio, ElevenLabs and any OpenAI-compatible endpoint. Inbound, it speaks three dialects natively: OpenAI (chat completions, completions, responses), Anthropic (messages, count_tokens) and Gemini (generateContent), plus realtime WebSockets for OpenAI, Azure OpenAI, ElevenLabs and Gemini Live. For Claude Code there is Claude via Bedrock or Vertex with prompt caching and thinking.

Governance: guardrails, MCP, routing and Flow Builder

Portkey documents “20+ deterministic guardrails” plus LLM-based checks; Aporia, SydeLabs and Pillar Security are named as partners. Input guardrails run before the stream starts, output guardrails on the fully assembled response after the stream completes. The Deny switch defaults to FALSE, so requests proceed despite a failed check; only with TRUE are they blocked. The MCP Gateway brings an MCP Registry, the auth modes OAuth Auto, Client Credentials and Custom Headers, identity forwarding, tool-level access and MCP guardrails. For routing, the product page names fallbacks, conditional routing, load balancing across API keys, canary testing, circuit breakers and retries, plus simple and semantic caching. A visual flow builder or routing by prompt complexity is not documented on the pages reviewed.

The innFactory AI Gateway ships nine guardrail rule types, from secret and PII detection through prompt injection and denied topics to groundedness and an external webhook. Actions are block, redact, warn and audit, every rule can run in shadow mode, redaction also applies mid-stream, and a GDPR preset is included. The MCP proxy exposes Streamable HTTP servers with eight upstream auth modes, access policies and named toolsets. The auto-router selects by prompt complexity. The Flow Builder is a visual graph with nine strategies, guardrail nodes with pass/block/fail and event triggers to webhooks; a flow is callable like a model and bills the same budgets.

What Portkey does better

Model and provider breadth: more than 1,600 models across over 50 providers according to the vendor.
Guardrail ecosystem: over 20 deterministic guardrails plus partners such as Aporia, SydeLabs and Pillar Security; per the Portkey blog, Prisma AIRS was already integrated as a guardrail in September 2025.
Identity stack: SAML 2.0, SCIM for Okta and an LDAP bridge are documented; currently not included in the innFactory AI Gateway.
Certifications: SOC 2, ISO 27001, GDPR and HIPAA are named on the vendor security page, along with a DPA.
Corporate backing: as part of Prisma AIRS, Palo Alto Networks places the gateway within its security platform, per the press release with agent identity through its Idira technology.
Community: an MIT repository with an npm package that anyone can start locally in minutes.

When Portkey is the right choice

You need a very large number of models and niche providers through one API.
SAML, SCIM or LDAP are mandatory today.
Dashboard, configuration and aggregated metrics may live at the vendor as long as prompts and responses stay in your own network.
Your company already relies on Palo Alto Networks.
You want to start with an open-source proxy without any further control plane.

When the innFactory AI Gateway is the right choice

Gateway, dashboard and all cost data must run entirely in your own Azure, STACKIT or Kubernetes tenant.
Budgets are to be managed in euros via cost centers with pool or per-user mode and a budget fallback.
SSO via Entra ID or Keycloak and seven roles must be included in every license tier.
You want to know the agent time of Claude Code, Codex and OpenCode per repository and cost center, including subscription usage.
STACKIT, IONOS or Gemini via the Vertex EU endpoint are among your providers.

Comparison at a glance

Criterion	Portkey (per documentation, as of September 26, 2026)	innFactory AI Gateway
License and tiers	Gateway MIT-licensed; tiers Open Source, Developer, Production, Enterprise	Monthly license by user count, 199 to 749 EUR excl. VAT
Deployment model	Hosted/SaaS, self-hosted via npx, hybrid with engine in customer VPC and control plane at the vendor	Everything in the customer tenant: Azure Container Apps/AKS, STACKIT, Kubernetes; no SaaS
Data path in hybrid mode	Prompts and responses in your own network; anonymized metrics to the vendor	Prompts, responses, logs, metrics and dashboard in the tenant
SSO and roles	Okta, Azure AD, OIDC/SAML, SCIM (Okta), LDAP bridge; SSO listed on the pricing page under Enterprise	Entra ID, OIDC (Keycloak, Cognito); seven roles in every license; SAML/SCIM currently not included
Budgets	API key, workspace, provider integration; no reset, weekly, monthly; USD	Organization, cost center (pool/per user), user, API key; day/week/month; EUR at ECB rate
Coding agents	Claude Code (Anthropic, Vertex, Bedrock), Codex, Cline, Claude Desktop, Agent SDK; measures proxied requests	Six tool setups, `aigw run`, companion for agent time incl. subscription usage, MDM rollout
Providers and dialects	1,600+ models, 50+ providers; OpenAI-compatible signature	13 provider types incl. STACKIT, IONOS, Vertex EU; OpenAI, Anthropic, Gemini natively; realtime
Guardrails and MCP	20+ deterministic plus LLM-based, Deny switch; MCP Gateway with three auth modes	Nine rule types, shadow mode, mid-stream redaction; MCP proxy with eight auth modes
Routing	Fallbacks, conditional routing, canary, circuit breaker, simple/semantic cache	Auto-router by complexity, deployment groups, Flow Builder with nine strategies

Conclusion

With the acquisition by Palo Alto Networks, Portkey is part of a large security platform, and the MIT-licensed gateway remains a good entry point for any team bundling many models behind one API. The hybrid deployment keeps prompts and responses in your own network; the control plane with dashboard and configuration stays with the vendor.

The innFactory AI Gateway is not built as a proxy for 1,600 models but as a governance and FinOps component in your own tenant: cost centers in euros, roles without tier limits, guardrails with shadow mode and a companion that makes the agent time of coding agents visible. If you want to keep control entirely in-house, this is the right place; if you want maximum breadth and a large vendor behind the product, Portkey is.

Natively integrated with CompanyGPT, one reusable stack

The AI Gateway is natively integrated with CompanyGPT: the same budgets, cost centers and guardrails apply to chat, agents and add-ons. Identity via Entra ID or Keycloak, cost centers, guardrails and the MCP registry form one stack that is reused across CompanyGPT, the gateway and every application that runs through the gateway. The gateway can just as well run standalone. Further comparisons are listed under all comparisons, the product page under AI Gateway.

Sources

Retrieved on September 26, 2026:

Portkey homepage (banner “Portkey is now PRISMA AIRS AI Gateway”, company address, model count) — https://portkey.ai/
Palo Alto Networks: Completes Acquisition of Portkey — https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-portkey-to-secure-ai-agents
Palo Alto Networks: General Availability of Prisma AIRS AI Gateway — https://www.paloaltonetworks.com/blog/2026/07/announcing-general-availability-of-prisma-airs-ai-gateway/
Portkey blog: Prisma AIRS Now on Portkey (September 2025) — https://portkey.ai/blog/fortifying-your-ai-stack-palo-alto-networks-prisma-airs/
Portkey Gateway repository — https://github.com/Portkey-AI/gateway
Portkey Gateway LICENSE (MIT) — https://github.com/Portkey-AI/gateway/blob/main/LICENSE
Portkey pricing (tier names) — https://portkey.ai/pricing
Portkey docs: AI Gateway (modes, routing, cache) — https://portkey.ai/docs/product/ai-gateway
Portkey docs: Private Cloud / Hybrid Deployment — https://portkey.ai/docs/product/enterprise-offering/private-cloud-deployments
Portkey docs: Security — https://portkey.ai/docs/product/enterprise-offering/security-portkey
Portkey Security and Compliance — https://portkey.ai/features/security-compliance
Portkey docs: SSO — https://portkey.ai/docs/product/enterprise-offering/org-management/sso
Portkey docs: SCIM Okta — https://portkey.ai/docs/product/enterprise-offering/org-management/scim/okta
Portkey docs: LDAP — https://portkey.ai/docs/product/enterprise-offering/org-management/ldap
Portkey docs: Budget Limits — https://portkey.ai/docs/product/ai-gateway/virtual-keys/budget-limits
Portkey docs: Enforce Budget and Rate Limit — https://portkey.ai/docs/product/administration/enforce-budget-and-rate-limit
Portkey docs: Workspace Budget Limits — https://portkey.ai/docs/product/administration/enforce-workspace-budget-limts-and-rate-limits
Portkey docs: Usage and Rate Limit Policies — https://portkey.ai/docs/product/enterprise-offering/budget-policies
Portkey docs: Observability — https://portkey.ai/docs/product/observability
Portkey docs: Integrations Libraries — https://portkey.ai/docs/integrations/libraries
Portkey docs: Claude Code — https://portkey.ai/docs/integrations/libraries/claude-code
Portkey docs: Claude Agent SDK — https://portkey.ai/docs/integrations/agents/claude-agent-sdk
Portkey docs: Coding Agents — https://portkey.ai/docs/product/coding-agent
Portkey docs: Portkey CLI — https://portkey.ai/docs/guides/coding-agents/agent-cli
Portkey docs: LLM Providers — https://portkey.ai/docs/integrations/llms
Portkey docs: Multimodal Capabilities — https://portkey.ai/docs/product/ai-gateway/multimodal-capabilities
Portkey docs: Guardrails — https://portkey.ai/docs/product/guardrails
Portkey docs: MCP Gateway — https://portkey.ai/docs/product/mcp-gateway
Portkey docs: MCP Registry — https://portkey.ai/docs/product/mcp-gateway/mcp-registry
Portkey docs: MCP Authentication — https://portkey.ai/docs/product/mcp-gateway/authentication
Portkey docs: MCP Tool Provisioning — https://portkey.ai/docs/product/mcp-gateway/tool-provisioning
Portkey docs: MCP Guardrails — https://portkey.ai/docs/product/mcp-gateway/guardrails

Note on the information: All statements about other vendors’ products are based on their publicly available documentation as of the stated date. Vendors continuously develop their products, features and terms — the vendor’s current information always prevails. If any statement appears outdated or incorrect to you, please drop us a line at info@innfactory.ai; we will review and correct it promptly. This comparison does not replace legal or data-protection advice in individual cases.

AI Gateway vs. Portkey (PRISMA AIRS AI Gateway): Hybrid deployment with a vendor-hosted control plane or an infrastructure component in your own tenant?