LLM Proxy Projects with Granular API Key Access Control: A Comprehensive Survey
type: NewsArticle
description: A new research report analyzing 38 open-source and managed LLM proxy projects finds the market rapidly maturing from simple protocol translators into comprehensive governance platforms. LiteLLM leads with the most complete feature set including virtual keys per user and team, while newer entrants like Bifrost and TensorZero offer lower latency and enterprise-grade access controls in their open-source tiers. The landscape is bifurcating between self-hostable proxies and managed SaaS platforms, with implications for data sovereignty and compliance.
date published: 2026-06-10T00:00:00+00:00
date modified: 2026-06-11T19:41:48+00:00
language: en
is accessible for free: true
article body: Post # LLM Proxy Projects with Granular API Key Access Control: A Comprehensive Survey A research report examining 38+ open-source and managed LLM proxy/gateway projects that provide API key management and granular access control — from LiteLLM and Bifrost to TensorZero and TrueFoundry, comparing their architectures, features, and trade-offs. ## Executive Summary This report identifies and analyzes **38+ open-source and managed LLM proxy/gateway projects** that provide API key management and granular access control capabilities. The market has matured rapidly from simple protocol-translating proxies into comprehensive governance platforms. The leading project, LiteLLM (~40K GitHub stars), offers the most complete feature set with virtual keys scoped per user, team, and budget — but faces performance limitations (Python GIL) and a supply-chain security breach in March 2026. Newer projects like Bifrost (5.6K stars, Go-based) claim 54× lower latency and deliver enterprise governance features in their open-source tier without paywalling RBAC or SSO. A significant expansion from the prior survey includes several notable new entrants: **TensorZero** (~11.4K stars, Rust-based, <1ms P99 latency) brings an ML-optimized gateway with tag-based rate limits; **TrueFoundry** offers enterprise-grade virtual accounts, RBAC, policy-as-code (Cedar/OPA), and SOC 2/HIPAA/ITAR compliance with on-prem deployment; **RelayPlane** (npm-native, Node.js) provides a local-first cost-intelligence proxy with MCP support and zero network-hop overhead; **OpenZiti LLM Gateway** (Go, Apache 2.0) delivers virtual API keys with model-level glob restrictions and zero-trust networking via zrok overlay. Additionally, managed-only platforms like **Kilo Gateway** (500+ models, BYOK), **nexos.ai** (founded by Nord Security creators, $35M funding), and **Braintrust Gateway** (organization-scoped and project-scoped API keys with AES-GCM caching) are tracked separately from self-hostable projects. The landscap…
publisher: Web Pulse
keywords: large-language-models, ai-infrastructure, ai-tools, ai-products, ai-research
mentions: LiteLLM
mentions: Bifrost
mentions: TensorZero
mentions: TrueFoundry
mentions: RelayPlane
mentions: OPA
mentions: Cedar
mentions: SOC 2
citation: CreativeWork