switch guide · updated 2026-10-26

Switch from Kong AI Gateway to TokenZero in one line

Kong AI Gateway is plugins on the Kong API gateway for routing, prompt guarding and metrics. TokenZero is a BYOK savings gateway: you keep Kong: TokenZero is an upstream you route to; no plugin to install, and every request comes back with a signed receipt for what it saved.

The change

OPENAI_BASE_URL=https://tokenzero.sh/w//v1
ANTHROPIC_BASE_URL=https://tokenzero.sh/w/
# provider keys stay in your code exactly as they are; nothing else changes

Create the workspace first:

curl -s -X POST https://tokenzero.sh/v1/signup -d '{}'   # workspace + key, no form
npx -y @tokenzero/cli init                                # or: audits the repo, writes .env

What differs from Kong AI Gateway

  • Cost engines (cache formatting, semantic cache, cascade) rather than policy enforcement.
  • Per-request signed savings receipts that a CFO can verify.
  • Hosted, free up to the monthly free tier.

What TokenZero does

  • Bring your own key. Provider keys pass through untouched; TokenZero never holds them.
  • Four engines. Prompt-cache formatting (Anthropic breakpoints, OpenAI prompt_cache_key / 12h retention), exact and semantic response cache, calibrated cascade routing with a shadow-parity breaker, and a signed savings ledger.
  • Measured, not claimed. Gateway overhead and the audit corpus are published on /benchmarks with the scripts that produced them.
  • Free up to $500/month of routed spend; paid plans are a share of verified savings with a 3x-ROI-or-$0 rule.

Verified, not reported

Every request through the gateway gets an Ed25519-signed receipt with list-price baseline, actual provider cost and the difference, chained per workspace (seq, prev_receipt_hash), verifiable offline with npx -y @tokenzero/cli verify --chain.

Questions

Where does TokenZero sit relative to Kong?
Behind it: Kong handles authentication and policy for your clients, forwards to TokenZero, which forwards to the provider with the customer's key.

Is there a migration tool?
No tool is needed: change the base URL (or the /w/<key>/ prefix) and keep your provider keys. Run npx -y @tokenzero/cli audit first to see what the gateway will act on.