Jeremy H - June 10, 2020
We’re examining Kong HQ vs. DreamFactory. The rise in demand for microservices-based applications that rely on APIs for connectivity has triggered an equal rise in demand for API gateway solutions. However, API gateways differ considerably in their features and underlying technology, so it’s important to investigate your selection to ensure it fits your needs.
In this guide, we take an in-depth look at Kong HQ vs. DreamFactory – two of the most advanced API gateway solutions on the market. We’ll start with a brief overview of both platforms. Then we’ll focus on distinctions that set them apart.
Please use the following links to navigate this guide:
Kong Overview
Kong is one of the leading open-source API gateway solutions on the market. Built on top of the HTTP proxy server NGINX, NGINX offers high-traffic performance and numerous Lua scripts and extensions for additional customization.
When looking at Kong HQ vs. DreamFactory, its important to consider their open-source options. In addition to the basic API proxy tools featured in its open-source version, Kong has a paid enterprise version that includes additional perks like:
- Advanced traffic control plugins
- Security
- Kafka support
- Administrator UI
- Developer portal
- Maintenance
- 24/7 customer support
Similar to DreamFactory, Kong offers a lot of deployment flexibility. You can run it on any operating system and deploy it with Docker, Vagrant, Kubernetes, or Bitnami. That being said, Kong is not entirely flexible when it comes to tailoring APIs with custom business logic. The platform only supports Lua and Golang, so developers are locked into those specific plugins.
Here’s how users are taking advantage of Kong:
“What problems are you solving with the product? API Management. Logging, Analytics, Monitoring, and Alerts. Supports several Authentication protocols. Plugin architecture means easily extensible and several options for any tasks for example for logging, you can use Loggly, Galileo, Httpd (Elastic search), Statsd (Graphite-Grafana), Syslog, etc. Huge support from the open-source community.”
“Our current API Management platform lacked adequate support for OAuth, OIDC and ultimately was not cloud-native friendly. Kong allowed us the opportunity to move forward with our cloud-native transition.”
DreamFactory Overview
DreamFactory is one of the most technologically advanced open-source API gateways available. Built using the Laravel framework and PHP, DreamFactory is configured as a LAMP stack, which makes it easy to scale both vertically (with additional processors) and horizontally (with a load balancer).
The most impressive feature that sets DreamFactory apart from Kong is its ability to automatically generate fully-documented REST API to integrate new application features in minutes. This empowers developers to quickly incorporate any database (SQL or NoSQL), file storage system, SOAP service, or HTTP service into their projects. Automatic API generation eliminates the time-consuming task of hand-coding APIs, so developers can spend more energy building applications.
In addition to its free, open-source version, DreamFactory offers three paid tiers (Small Business, Professional, and Enterprise). Depending on the tier, customers can receive additional features like:
- Unlimited customer support
- Rate limiting
- HIPAA, GDPR and PCI compliance
- Onsite training
- Advanced API monitoring
- Custom development
- More connectors
- Unlimited integrations
- Static IPs
- Automatic backup
Similar to Kong, DreamFactory offers a lot of deployment flexibility. You can run DreamFactory on any operating system (on-prem, cloud, or hybrid) and you can deploy it via Docker, Kubernetes, Bitnami, or directly from GitHub. Furthermore, DreamFactory offers a great deal of flexibility when tailoring APIs with custom business logic. DreamFactory supports custom scripting in PHP, Python, V8JS, and NodeJS.
Here’s what users are saying about DreamFactory:
“Fastest and easiest API Management tool my department has ever used. We used DreamFactory to build the REST APIs we needed for a series of projects and were able to save tens of thousands on the developer hours it would have taken otherwise.”
“The ease of connecting relational data sources with file systems and objects, generating understandable and extraneous powerful APIs in a few clicks, coupled with ACL control and triggered script processing in internal API events, is extremely scalable. Run it all on the infrastructure provider I want.”
“With DF it was possible to envelop the legacy systems that we have, adopting a granular strategy in the migration to microservices. Centralizing access control with support for several roles for different types of users and applications was a significant milestone for us. We reduced implementation time and kept the team lean.”
After this general overview of Kong and DreamFactory, let’s dive deeper into the most important distinctions between the platforms.
Side-by-Side Comparison
Here’s a side-by-side comparison of Kong vs. DreamFactory:
| Products | Kong | DreamFactory |
| Deployment | Single node deployment | Flexible to deploy as multiple nodes. The only requirement is that all instances share the same system database and cache |
| Databases | Cassandra or PostgreSQL only | MySQL, SQL Server, PostgreSQL, or SQLite as your system database. DreamFactory also includes connections to many SQL and NoSQL databases. |
| Type of Open Source | Apache 2.0 | Apache 2.0 |
| Underlying Technology | NGINX/Lua | Laravel framework and PHP |
| On-Prem vs. Cloud | Both | Both |
| Community | A large, well-established community | A highly active community of 2,000 members and growing |
| Authorization and API Keys Available? | Yes | Yes. User Management, SSO Authentication, JSON Web Tokens (JWT), CORS, Role-Based Access Control on API endpoints, record-level permissions on data, OAuth, LDAP, Active Directory, SAML integration, and more |
| Rate Limiting Features | Available through the Rate Limiting Plugin | API rate limits at the instance, role, user, and endpoint level |
| Transformations | HTTP | Transforms responses to suit client requirements (HTTP, XML, JSON, etc.) |
| Native GUI? | Only Kong Enterprise Version | Yes. Native GUI available in the free and paid versions |
| Built-in Metrics? | Only Kong Enterprise Version | Only DreamFactory Enterprise Version |
| Custom Scripting | Lua or Golang | NodeJS, V8JS, PHP, and Python |
| Automatic REST API Generation | No | Yes |
Automatic REST API Generation
From the developer’s perspective, DreamFactory’s ability to rapidly generate fully-documented REST API is one of the most important points of departure from Kong.
Kong REST API Generation: Kong vs. DreamFactory
While Kong is an exemplary API Proxy – and even though you can mount existing APIs to Kong – the platform doesn’t offer any native connectors or tools to automatically generate APIs. If you can’t import an existing API, Kong forces you to hand-code a new one from scratch – adding weeks or months to the project completion date.
DreamFactory REST API Generation
Automating the creation of APIs saves time, so you can focus on coding your applications, not APIs. For this reason, DreamFactory’s capacity to automatically generate REST API for nearly any data source is a game-changer and tremendous cost and time saver for development teams. Like Kong, you can mount existing APIs to the platform, but when no API exists, DreamFactory eliminates the time bottleneck of API creation.
Imagine you want to integrate a SOAP service into your system, but there’s no API for it. DreamFactory’s point-and-click API generation tool creates fully-documented, ready-to-use REST API in minutes. By removing the burden of API creation, DreamFactory empowers development teams to achieve a dramatically faster time to market.
Users say the following about this feature:
“DreamFactory REST API in seconds? Yeah, that’s true!! Live documentation of REST API’s is a pain for developers. DreamFactory solved this using Swagger-UI. This is the most interesting and lovable thing done by DreamFactory.”
“APIs are built for you – and not just any APIs. Fully documented, fully secured (OAuth, LDAP, Active Directory, SAML Integration…) and accessible through a 3rd party client.”
API Customization (Custom Business Logic)
Both Kong and DreamFactory allow you to customize APIs with custom business logic. However, DreamFactory offers more flexibility to use the most popular scripting languages.
Kong API Customization
When it comes to adding custom business logic, Kong only supports Lua and Golang, so developers are locked into their associated plugins. This is not a downside for all users – as Lua and Golang offer the advantages of being easy to learn, easy to embed as a scripting language, and support for powerful abstractions like function closures and object orientation.
Since Kong is locked into Lua and Golan, the platform is more appropriate for large enterprises that use these languages for their projects. Generally speaking, Kong is too limited for the average microservices developer.
Here’s what users say about Kong’s reliance on Lua and Golang:
“Kong is wonderful if you enjoy Lua with Openresty and look to have an all-in-one solution for API implementation and management. Lua is not as popular as it should be, but Openresty has proven performance and a strong community. For developers using either (likely both) technology, Kong is exciting and fun to implement…
Kong’s use case is a bit too specific to bring over most modern microservice devs to the table. This really limits Kong to just large enterprise contracts which likely do not have as large of a consumer base due to the usage of Lua.
I found Kong looking for active products implementing Openresty. I assume 90% of Kong’s customers also do the same.”
“Lua Scripting Language makes it easy to understand and write code for Kong.”
“You should consider evaluating other API Gateway solutions before moving ahead with Kong. Also, keep in mind that should you ever need to develop a plugin of your own, it needs to be implemented in LUA.”
DreamFactory API Customization: Kong vs. DreamFactory
DreamFactory departs from Kong by allowing custom scripting in four different languages: PHP, Python, NodeJS, and V8JS. These scripts can be pre- or post-process scripts attached to certain endpoints. You can bring in custom packages as well. In this way, DreamFactory empowers developers to use their favorite Javascript, PHP, and Python packages to extend the platform to fit their needs.
One user says the following about DreamFactory’s API customization features:
“This is awesome… Node.js (javascript) and PHP support for server-side scripting simplify the amount of work I have to do. I don’t have to hire a separate person to use DreamFactory. In every company, in-house teams will have an idea on these languages. A proper understanding of documentation is enough to handle day to day tasks.”
User Interface (UI)
Kong’s free, open-source version does not have a user interface while DreamFactory’s free, open-source version does have a user interface.
Kong User Interface
Much to the chagrin of many Kong users, the open-source version of Kong lacks a native user interface. This can make Kong difficult to use, especially for developers who are new to the platform. Fortunately, there are third-party UIs for Kong, like Konga. Moreover, the paid version of the platform – Kong Enterprise – includes an administrator UI.
Here’s what it looks like to use the free, open-source version of Kong:
Source: Kong Youtube Channel
Users say the following about Kong’s lack of UI:
“Kong lacks a user interface, which I think might speed up the process of getting familiar with Kong. It will make sense, far more intuitive.”
“What do you dislike? Lack of an Official UI or Administration Panel.”
“What do you dislike? The interface still can be quite daunting for a novice user.”
“What do you dislike? No built-in UI for non-programmers to access admin UI for onboarding clients, APIs, etc.”
DreamFactory User Interface
A clear advantage of open-source DreamFactory over Kong is the fact that the free version of DreamFactory includes a graphical user interface. The DreamFactory UI is easy and intuitive to use. As a true workhorse of an API gateway, DreamFactory’s user interface was made to be intuitive, utilitarian, and to get the job done in the most efficient way possible.
Here’s a sample video of DreamFactory’s UI in action while auto-generating a Salesforce REST API. This API was auto-generated in six minutes. Note the full swagger documentation:
Here’s what users say about the DreamFactory UI:
“The UI is also very easy and made our particular use case involving turning SOAP services to REST a dream. Once we configured server-side scripting, it completed our SOAP to REST translation automatically for us. Support has been fantastic! Erik, one of the engineers there, has been notably excellent.”
“It’s a pretty intuitive UI, so all of our team members have been able to get up and running pretty quickly.”
“UI isn’t very pretty, but it’s an 11/10 on functionality and productivity.”
*Please note that the DreamFactory UI was completely revamped for Version 3. This 2018 review doesn’t reflect these updates, which markedly improved the UI esthetics and overall user experience.
Documentation, Installation, and Configuration
Kong’s lack of clear documentation makes installation and configuration difficult. In contrast, DreamFactory includes documentation that is clear, concise, and easy-to-follow.
Kong Documentation, Installation, and Configuration: Kong vs. DreamFactory
Kong’s documentation is not up to par with a typical enterprise-grade API gateway – making installation complicated and time-consuming. The issue is reflected in user reviews:
“I explored using Kong for a brief minute. It looks robust with tons of useful plugins. However, the documentation left something to be desired and I found myself in click loops trying to find out how to do something simple. Specifically, trying to integrate Istio mesh with Kong was confusing, and they kept trying to link me to Kuma(?) when I really just wanted a quick overview of how the integration should work.”
Another Reddit user concurred:
“This was my experience too. Their docs are terrible.”
Other reviewers say:
“The documentation around Kong Enterprise wasn’t very clear when we started evaluating the product so it made the learning curve a bit more complicated, but the team was very responsive and they also took our feedback and revisited their documentation (thanks!).”
“I feel the documentation is still developing. There are several instances where the documentation does not list the full capabilities of the product making it difficult to understand.”
“Kong has moderate complexity when it comes to deployment … Some plugins such as the rate-limiting one optionally require additional data stores such as Redis. However, a production deployment isn’t as complicated as Apigee.”
DreamFactory Documentation, Installation, and Configuration
DreamFactory offers clear, concise, easy-to-follow documentation. This makes installing and configuring DreamFactory a breeze while minimizing setup delays. Here’s how one user describes DreamFactory documentation:
“Great Security and very complete and user-friendly documentation. Example apps get you going quick! I can’t think of anything not to like… Once you have read the documentation and looked at the sample apps, you’re on your way.”
Transformations
Kong is limited when it comes to data transformations. DreamFactory is flexible to transform data according to client requirements.
Kong Transformations
Kong performs HTTP-based transformations only. It can’t perform SOAP or XML transformations. This isn’t a problem unless you’re dealing with older apps and services that require the XML format.
If you’re not dealing with legacy platforms, older messaging formats, or industry-specific systems, you might appreciate the fact that Kong isn’t burdened by these additional transformation layers.
DreamFactory Transformations
DreamFactory offers a wide range of data transformation layers to manage transformations to suit the requirements of the client. Whether its HTTP, SOAP, JSON, XML, etc., DreamFactory can transform responses between different formats. For example, the platform instantly converts the JSON requests to SOAP and SOAP requests to JSON.
One user says the following about DreamFactory’s data transformation capabilities:
“One feature that we didn’t know existed at first is the ability to write your own transformation scripts/routines. You can think of it as the “T” layer in an ETL process but applied directly to your API. This was our original concern with using DreamFactory, but after seeing they had this already built-in, it washed all our concerns away. They have this stuff set up really well.”
“We have many disparate data sources that we need to eventually aggregate into an API, and a lot of transforming that needs to happen as well. This is all plug-n-play with DreamFactory.”
API Security
When comparing Kong and DreamFactory’s API security features, the primary difference is that Kong doesn’t natively secure APIs, but DreamFactory does.
Kong API Security
You can achieve all of your API security needs with Kong. The potential issue is what happens when you put Kong in the hands of an inexperienced or absent-minded user. Since APIs are not automatically secure in Kong, users could unknowingly publish sensitive data without realizing it if they forget to take the additional steps to secure the API.
In fact, this is how most data breaches occur – a developer inadvertently fails to set authentication and role-based access control for an API and exposes private information absent-mindedly. An experienced and careful developer wouldn’t normally commit such an error, but mistakes can happen.
DreamFactory API Security
DreamFactory takes a different approach to security. Each API is automatically secured at a minimum with an API key and role-based access control, and you have to purposefully and specifically grant access to make data publicly available. This minimizes the chance of leaving sensitive information available to anyone with the API endpoint address.
Authentication services, role-based access control, and other security features are also fast and easy to integrate with DreamFactory. Just cut and paste a few lines of code to call DreamFactory, and the API gateway connects with the authentication service and handles the rest.
DreamFactory also allows you to standardize security across your entire app infrastructure by ensuring that all connections adhere to GDPR, SOC2, CCPD, or other security standards depending on your needs.
DreamFactory’s security features include:
- User management
- SSO authentication
- CORS
- JSON web tokens
- SAML
- Role-based access control for all API endpoints
- Authentication services like OAuth, Active Directory, Okta, Google, and more
- LDAP
Finally, when comparing Kong HQ vs. DreamFactory, DreamFactory quickly updates with security patches after identifying a security vulnerability. At the time of this writing, Bitnami confirms that DreamFactory’s last security patch occurred on April 22, 2020. Check Bitnami for the latest information on DreamFactory updates.
Pricing
The primary difference between Kong and DreamFactory’s pricing is that Kong’s paid tier is for large enterprises, which means it is expensive and difficult to budget for small businesses. In contrast, DreamFactory offers more affordable tiers for small businesses and startups, in addition to an enterprise version.
Kong Pricing
While Kong Gateway is free, many users choose to upgrade to Kong Enterprise for additional features like:
- Built-in metrics
- Native administrator UI
- Enterprise plugins
- Role-based access control
- Machine learning powered anomaly detection
- Kong Studio integrated development environment
Kong Enterprise doesn’t disclose pricing, so it’s difficult to estimate the cost without talking to a sales representative. What’s safe to say is that Kong Enterprise was built for large enterprises, so you should expect enterprise-level pricing. Kong is generally too expensive for startups and small to medium sized businesses.
“I did an extensive evaluation of API gateways a couple of months ago and found tons of great solutions out there! Highly recommend not building your own. We started with Kong which is great to get up and going quickly and easy to configure but moved away because of their pricing model (not startup-friendly).”
DreamFactory Pricing
When it comes to Kong vs. DreamFactory, the free, open-source version of DreamFactory includes a lot more features than the free version of Kong HQ. Open-source DreamFactory has a native UI, auto-generated API documentation, and the ability to manage API keys all baked into the platform. Upgrading to one of DreamFactory’s three paid versions (Small Business, Professional, and Enterprise) gives you access to even more benefits.
The paid versions of DreamFactory offer additional features like:
- Unlimited Integrations
- More connectors
- Unlimited Users
- 100K calls per month
- Integration engine for standard connections
- Scripting engine for standard connections
- 99.8% uptime
- Automatic backup
- Static IPs
- Up to 5 licenses
- Advanced API monitoring
- Onsite training
- Onsite configuration support
- Custom development
- Rate limiting
- HIPAA, GDPR, and PCI compliance
- Chat, email support
Final Thoughts on Kong HQ vs. DreamFactory
After reading this review of Kong vs. DreamFactory, you should have a clear picture of the most compelling differences between the platforms. Ultimately, the use-cases for Kong and DreamFactory have a lot of overlap, but there are some clear differences that you might want to consider when choosing one over the other:
- Automatic REST API generation: DreamFactory’s API generation tools create REST API from any data source automatically in minutes. This can save you thousands of developer hours by eliminating the need to hand-code REST APIs. Kong does not have automatic API generation.
- UI included in the free version: DreamFactory’s free, open-source version includes an intuitive, easy-to-use UI. Kong’s free version does not.
- Quickly connect to virtually any SQL/NoSQL database: DreamFactory provides a comprehensive and secure connection to any SQL database and almost any NoSQL database.
- Pricing for small businesses and startups: DreamFactory offers pricing tiers to fit the needs of small businesses, startups, and large enterprises alike. The price of Kong’s paid version limits the platform to large enterprises only.
- Data transformations: DreamFactory can manage data transformations between HTTP, SOAP, JSON, XML, and more. Kong is limited to HTTP transformations.
- Custom business logic: DreamFactory supports custom scripting in PHP, Python, NodeJS, and V8JS. Kong is limited to Lua and Golang.
If you’re deciding between Kong vs. DreamFactory, we recommend trying DreamFactory before making a decision. Once you experience how easy it is to auto-generate REST API with DreamFactory, we think you’ll want to join our growing community of passionate developers.
Start your free, 14-day hosted trial of DreamFactory today!
Fascinated by emerging technologies, Jeremy Hillpot uses his backgrounds in legal writing and technology to provide a unique perspective on a vast array of topics including enterprise technology, SQL, data science, SaaS applications, investment fraud, and the law. Contact Jeremy at [email protected].