Tyk — Open Source API Gateway with Developer Portal

What it is

Tyk is a high-performance, open-source API gateway written in Go. It handles quota enforcement, rate limiting, authentication (OAuth2, OIDC, JWT, HMAC, mTLS), request/response transformations, analytics, and a developer portal. You can deploy it as a single binary, a Docker container, or a full Kubernetes operator.

Tyk is built for teams that need a self-hosted gateway without vendor lock-in. Platform engineers, DevOps teams, and API product managers use it to manage internal and external APIs at scale.

How it saves time or tokens

Instead of building rate limiting, auth middleware, and analytics from scratch, Tyk provides all of these as declarative configuration. A single API definition JSON file replaces hundreds of lines of custom middleware code. Hot-reloading means you push config changes without restarting the gateway process, reducing deployment risk.

For AI workloads, Tyk can sit in front of LLM API endpoints to enforce per-consumer rate limits and track token-level usage through its analytics pipeline.

How to use

1. Clone the official Docker Compose stack and start Tyk with Redis:

git clone https://github.com/TykTechnologies/tyk-gateway-docker
cd tyk-gateway-docker
docker compose up -d

1. Register an API by posting a definition JSON to the gateway admin endpoint.

1. Hot-reload the configuration so the new API is live without downtime:

curl localhost:8080/tyk/reload/group \
  -H 'x-tyk-authorization: YOUR_SECRET'

Example

A minimal API definition that proxies requests to an upstream service with rate limiting enabled:

{
  'name': 'My API',
  'api_id': 'my-api-1',
  'proxy': {
    'listen_path': '/my-api/',
    'target_url': 'https://httpbin.org'
  },
  'rate_limit': {
    'rate': 100,
    'per': 60
  },
  'active': true
}

This routes all traffic on /my-api/ to httpbin.org with a cap of 100 requests per 60 seconds.

Related on TokRepo

• AI Gateway Providers -- Compare API gateways purpose-built for AI traffic routing and observability
• DevOps Automation Tools -- Infrastructure tools that pair well with API gateway deployments

Common pitfalls

• Forgetting to run tyk/reload/group after config changes. Without the reload call, new API definitions are not picked up.
• Using the default authorization secret in production. Always rotate the x-tyk-authorization header value before exposing the admin API.
• Skipping Redis persistence configuration. Tyk uses Redis for rate-limit counters and session storage; losing Redis data resets all quotas.