UniFi Cloud Key vs Cloud Gateway vs UniFi controller: which do you need?

A UniFi Cloud Gateway is a router with the UniFi controller built in. A Cloud Key is a small box that runs only the controller, next to a router you choose separately. The controller itself is software: Ubiquiti says "UniFi Controller" is the informal name for the UniFi Network application.

So the real question is where that software should run. Ubiquiti lists five options, which it calls control planes: a Cloud Gateway, a Cloud Key, UniFi OS Server on your own hardware, Official UniFi Hosting, and an NVR for cameras and doors (Understanding UniFi Cloud Architecture). Third-party hosting providers add a sixth.

This guide compares them on capacity, apps, price, gateways and what happens when something goes offline. Prices are from Ubiquiti's US store on September 25, 2026. Single prices are base prices, before the store's surcharge.

The options at a glance

Ubiquiti's five options all show up in UniFi Site Manager at unifi.ui.com. Ubiquiti says the management experience there is identical whichever you pick. Our Site Manager guide explains how that works.

Cloud Gateways: router and controller in one box

Ubiquiti "strongly recommend[s]" starting with a Cloud Gateway (Choosing the Right UniFi Control Plane). One box handles routing, firewall and VPN, and runs the UniFi apps. For a single home or office, that's hard to beat: no extra hardware and no subscription.

Ubiquiti rates each model by how many UniFi devices it can manage. The figures below come from its tech specs pages. Prices are the US store base price, then the price with the store's surcharge included.

Three things to check before you buy:

• The UCG-Ultra and the EFG (Enterprise Fortress Gateway) list only UniFi Network in their tech specs. For cameras or door access, pick another model or add a separate console.
• Ubiquiti says to run one Cloud Gateway per site, or one Shadow Mode pair (Running Multiple UniFi Network Consoles on the Same Site).
• Shadow Mode is Ubiquiti's failover pairing. It needs two rack models of the same type: UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG or EF-Core. Two UXG-Enterprise gateways can also pair up (Shadow Mode High Availability).

Check that automatic backups are on. With automatic system backups enabled, the console makes a cloud backup every week and before each major update. Only the console's owner can manage those backups (Backups and Migration in UniFi).

Choosing between the two compact models? See Cloud Gateway Max vs Cloud Gateway Ultra.

Cloud Keys: a controller next to any router

A Cloud Key runs UniFi OS and the UniFi apps, and leaves routing to something else. That can be a UniFi Independent Gateway (UXG) or a router from another brand.

The CloudKey+ suits a small site that wants cameras or door access without a Cloud Gateway. Its tech specs list camera limits but no device count.

The CloudKey Enterprise is a 1U rack console for large networks. Ubiquiti's Help Center describes it as "supporting up to 1,000 APs and switches". Our CloudKey Enterprise review goes deeper.

The first-generation Cloud Key (UC-CK) is on Ubiquiti's Legacy list, which means it no longer gets updates (Vintage and Legacy Products). If you still run one, plan a replacement.

UniFi OS Server and hosted controllers

You don't need UniFi hardware to run the controller. Three options put it on a server.

UniFi OS Server (self-hosted)

UniFi OS Server is Ubiquiti's free software for running the controller on your own machine. Ubiquiti calls it "the new standard for self-hosting UniFi", replacing the older UniFi Network Server. It needs at least 2 GB of RAM and 10 GB of free disk, and runs on Linux, Windows 10 or later, and macOS (Self-Hosting UniFi).

Installation, maintenance and uptime are yours. To view and manage your devices, the server "must continue running at all times". Our UniFi OS Server guide covers the details.

Official UniFi Hosting

Official UniFi Hosting is the same controller, run by Ubiquiti in its own cloud. Comparing it with UniFi OS Server, Ubiquiti's Help Center says "Functionally, they are the same." The difference is who maintains it.

There are two plans, chosen by device count (Getting Started with Official UniFi Hosting). They cost $29 a month for up to 100 UniFi Network devices and $99 a month for up to 1,000. In the EU the same plans cost €29 and €99. These are the prices Ubiquiti's sign-up flow showed in September 2026. One instance can't go above 1,000 devices, so larger fleets need a second instance.

Third-party managed hosting

Hosting providers run UniFi OS Server or the Network application on their servers and look after it for you. Ubiquiti's documentation doesn't cover these providers, so ask each one which gateways and versions it supports.

Our UniFi cloud controller guide walks through the setup. Our Cloud Key alternatives post compares self-hosting and hosting services.

Protect and Access need a console

None of the server options run the other UniFi apps. Ubiquiti says Protect, Access, Talk and Connect "must be hosted on a compatible UniFi Console". Official UniFi Hosting adds Talk Relay, for Talk phones on a third-party phone system.

You can combine them. A CloudKey+ or an NVR can run Protect or Access next to a hosted controller. It just can't run Network for the same devices, because a UniFi device can only be managed by one host.

The gateway question

Cloud Gateways can't be managed by an external controller. In Ubiquiti's words, they "cannot be managed by an external UniFi OS Server", because they already run the Network application themselves. Official UniFi Hosting has the same rule.

For a UniFi router at a site that runs on a Cloud Key, UniFi OS Server or a hosted controller, use an Independent Gateway (UXG). The UXG-Lite and UXG-Max store pages, for example, say they are "Managed with a CloudKey, Official UniFi Hosting, or UniFi OS Server".

You can also keep a router from another brand. The access points and switches still work with the controller. They just need to reach it on the ports Ubiquiti lists, such as TCP 8080 (Required Ports Reference). Our post on third-party gateways covers what you give up.

What happens when the controller goes offline

Your network keeps running. For UniFi OS Server, Ubiquiti says that if it goes offline, "your devices will continue to run using the last available configuration". You can't view or change anything until it's back.

What differs is what fails together:

• Cloud Gateway: the router and the controller are one box. If it fails, the site loses its internet connection and its management at the same time. Shadow Mode on the rack models is Ubiquiti's answer to that.
• Cloud Key: the router keeps working. You lose management until the Cloud Key is back or replaced.
• Local internet outage: a Cloud Gateway or Cloud Key is on site, so you can still reach it locally. Ubiquiti says sites remain "fully manageable through direct local access" when the internet is down.
• Hosted or central controller: it keeps running when one site goes dark. It can reach that site's devices again once the site's internet connection is back.

Which one do you need?

• One home or office: a Cloud Gateway. The UCG-Ultra covers a Network-only setup; choose a model with Protect in its tech specs if you want cameras.
• You want to keep your current router: a CloudKey+ at the site, or a server-based controller.
• Cameras or door access: a console at the site. That can be a Cloud Gateway that runs Protect and Access, a CloudKey+, or an NVR.
• Many sites or client networks: two approaches work, described below.

Ubiquiti argues that a Cloud Gateway at every site is "functionally and administratively equivalent" to one central UniFi OS Server, and "in many cases" simpler to run. With that model, each site has its own controller to update and back up.

The other approach is one central controller, self-hosted or hosted, with a UXG or your own router at each site. Then you have one server to keep running, and the sites don't need a Cloud Gateway. The right choice depends on hardware per site, how you handle updates and backups, and who looks after the controller.

Frequently asked questions

Do I need a Cloud Key if I have a Cloud Gateway?

No. The Cloud Gateway already runs the UniFi Network application. A Cloud Key can't run Network for the same devices, although Ubiquiti suggests one for offloading Talk or Connect on larger sites.

Can a hosted or self-hosted controller manage a Dream Machine?

No. Cloud Gateways, including the UDM and UCG models, run their own controller. UniFi OS Server and Official UniFi Hosting can't adopt them. Use a UXG at sites with a central controller.

Is the Cloud Key Gen1 still supported?

No. Ubiquiti lists the UC-CK as Legacy, which means it has stopped receiving updates. The CloudKey+ models don't appear on that list.

Can I run UniFi Protect on UniFi OS Server or a hosted controller?

No. Ubiquiti limits Protect, Access, Talk and Connect to UniFi consoles. Run them on a CloudKey+, an NVR or a Cloud Gateway that supports them, next to your hosted controller.

Does a Cloud Key work with a non-UniFi router?

Yes. A Cloud Key only runs the controller, so the router can be any brand. Ubiquiti notes that most people pair it with a UXG for UniFi's routing, VPN and security features.

Final thoughts

For one home or office, follow Ubiquiti's advice: a Cloud Gateway is the simplest setup, and the UCG-Ultra at $129 is a cheap way in. A Cloud Key fits sites that keep their own router. Protect and Access run only on UniFi consoles, so plan one on site if you need them.

Self-hosting UniFi OS Server works well for a home lab or a team with time for updates and backups. For client networks, UniHosted runs UniFi OS Server as a managed service, with daily backups, tested updates and monitoring on paid plans. Your hosted controllers show up in Site Manager next to your other sites, and the free plan covers five devices with no credit card required.