Gumloop vs Kestra

Gumloop

Gumloop's REST API has a public OpenAPI file with 105 operations, Markdown docs and a changelog with 28 dated releases since 9 July 2026. API keys need the $37 Pro plan, the trial needs a card, the key can travel in the URL, and self-serve content may be used to train Gumloop's models.

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Gumloop

1. Send the key as Authorization: Bearer and, for a personal key, add the x-auth-key header with the user ID. Do not put api_key in the URL
2. Create sessions with POST /agents/{agent_id}/sessions, then poll GET /sessions/{session_id}. A 202 means processing or queued, and the reply is not in the response
3. Supply your own session_id when creating a session. A repeat returns 409, which makes a retry safe
4. For streamed output send the same body with stream: true to ws.gumloop.com. api.gumloop.com answers 400 to it
5. Treat a webhook trigger URL as a password. It returns {"success": true} at once and never carries the agent's output

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth