Zum Inhalt springen
1337skills 1337skills - Referenzen

Tyk Cheat Sheet

Overview

Tyk is an open-source API gateway and management platform that provides high-performance request proxying, authentication, rate limiting, analytics, and developer portal capabilities. It is written in Go and supports REST, GraphQL, gRPC, and TCP proxying with minimal latency overhead.

Tyk offers three deployment models: Tyk Open Source (gateway only), Tyk Self-Managed (full platform with dashboard), and Tyk Cloud (SaaS). The gateway supports custom middleware in JavaScript, Python, Go, and gRPC, along with comprehensive API analytics, versioning, and developer key management.

Installation

Docker

# Tyk Gateway (Open Source)
docker run -d --name tyk-gateway \
  -p 8080:8080 \
  -v $(pwd)/tyk.conf:/opt/tyk-gateway/tyk.conf \
  -v $(pwd)/apps:/opt/tyk-gateway/apps \
  tykio/tyk-gateway:latest

# Tyk with Dashboard (Docker Compose)
git clone https://github.com/TykTechnologies/tyk-pro-docker-demo.git
cd tyk-pro-docker-demo
docker compose up -d

Helm Chart (Kubernetes)

helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update

# Open Source gateway
helm install tyk-oss tyk-helm/tyk-oss \
  --namespace tyk --create-namespace \
  --set global.redis.addrs="{redis.tyk.svc:6379}"

# Full stack with dashboard
helm install tyk-pro tyk-helm/tyk-pro \
  --namespace tyk --create-namespace \
  -f values.yaml

Linux Package

# Add Tyk repository
curl -s https://packagecloud.io/install/repositories/tyk/tyk-gateway/script.deb.sh | sudo bash

# Install
sudo apt-get install tyk-gateway

# Bootstrap
sudo /opt/tyk-gateway/install/setup.sh \
  --dashboard=0 --listenport=8080 --redishost=localhost --redisport=6379

# Start
sudo systemctl start tyk-gateway
sudo systemctl enable tyk-gateway

Gateway Configuration (tyk.conf)

{
  "listen_port": 8080,
  "secret": "your-gateway-secret",
  "node_secret": "your-node-secret",
  "template_path": "/opt/tyk-gateway/templates",
  "use_db_app_configs": false,
  "app_path": "/opt/tyk-gateway/apps",
  "storage": {
    "type": "redis",
    "host": "localhost",
    "port": 6379,
    "optimisation_max_idle": 2000,
    "optimisation_max_active": 4000
  },
  "enable_analytics": true,
  "analytics_config": {
    "type": "csv",
    "csv_dir": "/tmp",
    "enable_detailed_recording": true
  },
  "health_check": {
    "enable_health_checks": true,
    "health_check_value_timeouts": 60
  },
  "enable_bundle_downloader": true
}

API Definitions

Create an API (File-Based)

{
  "name": "My API",
  "slug": "my-api",
  "api_id": "my-api-1",
  "org_id": "default",
  "active": true,
  "use_keyless": false,
  "definition": {
    "location": "header",
    "key": "x-api-version"
  },
  "auth": {
    "auth_header_name": "Authorization"
  },
  "version_data": {
    "not_versioned": true,
    "versions": {
      "Default": {
        "name": "Default",
        "use_extended_paths": true
      }
    }
  },
  "proxy": {
    "listen_path": "/api/",
    "target_url": "http://backend:3000/",
    "strip_listen_path": true,
    "preserve_host_header": false
  }
}

Gateway API

# Create an API via Gateway API
curl -X POST http://localhost:8080/tyk/apis \
  -H "x-tyk-authorization: your-gateway-secret" \
  -H "Content-Type: application/json" \
  -d @api-definition.json

# List APIs
curl http://localhost:8080/tyk/apis \
  -H "x-tyk-authorization: your-gateway-secret"

# Get specific API
curl http://localhost:8080/tyk/apis/my-api-1 \
  -H "x-tyk-authorization: your-gateway-secret"

# Update an API
curl -X PUT http://localhost:8080/tyk/apis/my-api-1 \
  -H "x-tyk-authorization: your-gateway-secret" \
  -H "Content-Type: application/json" \
  -d @api-definition.json

# Delete an API
curl -X DELETE http://localhost:8080/tyk/apis/my-api-1 \
  -H "x-tyk-authorization: your-gateway-secret"

# Hot reload (apply changes)
curl http://localhost:8080/tyk/reload/group \
  -H "x-tyk-authorization: your-gateway-secret"

Authentication

API Key Authentication

{
  "use_keyless": false,
  "auth": {
    "auth_header_name": "Authorization",
    "use_param": false,
    "use_cookie": false
  }
}
# Create an API key
curl -X POST http://localhost:8080/tyk/keys \
  -H "x-tyk-authorization: your-gateway-secret" \
  -d '{
    "allowance": 1000,
    "rate": 100,
    "per": 60,
    "expires": -1,
    "quota_max": -1,
    "access_rights": {
      "my-api-1": {
        "api_name": "My API",
        "api_id": "my-api-1",
        "versions": ["Default"]
      }
    }
  }'

JWT Authentication

{
  "use_keyless": false,
  "enable_jwt": true,
  "jwt_signing_method": "rsa",
  "jwt_source": "https://auth.example.com/.well-known/jwks.json",
  "jwt_identity_base_field": "sub",
  "jwt_policy_field_name": "pol"
}

OAuth2

{
  "use_oauth2": true,
  "oauth_meta": {
    "allowed_access_types": ["authorization_code", "refresh_token"],
    "allowed_authorize_types": ["code"],
    "auth_login_redirect": "https://app.example.com/login"
  }
}

Rate Limiting and Quotas

{
  "global_rate_limit": {
    "rate": 1000,
    "per": 60
  },
  "disable_rate_limit": false,
  "disable_quota": false
}
# Set rate limit on a key
curl -X POST http://localhost:8080/tyk/keys \
  -H "x-tyk-authorization: your-gateway-secret" \
  -d '{
    "rate": 10,
    "per": 1,
    "quota_max": 10000,
    "quota_renewal_rate": 3600,
    "access_rights": {
      "my-api-1": {
        "api_name": "My API",
        "api_id": "my-api-1",
        "versions": ["Default"],
        "limit": {
          "rate": 50,
          "per": 60,
          "quota_max": 5000,
          "quota_renewal_rate": 3600
        }
      }
    }
  }'

Middleware and Plugins

URL Rewriting

{
  "version_data": {
    "versions": {
      "Default": {
        "use_extended_paths": true,
        "extended_paths": {
          "url_rewrites": [
            {
              "path": "/old-endpoint",
              "method": "GET",
              "match_pattern": "/old-endpoint(.*)",
              "rewrite_to": "/new-endpoint$1"
            }
          ],
          "transform_headers": [
            {
              "path": "/api/*",
              "method": "GET",
              "add_headers": {"X-Custom": "value"},
              "delete_headers": ["X-Remove-Me"]
            }
          ]
        }
      }
    }
  }
}

Custom JavaScript Middleware

// middleware/pre-auth.js
var myMiddleware = new TykJS.TykMiddleware.NewMiddleware({});

myMiddleware.NewProcessRequest(function(request, session) {
    // Add custom header
    request.SetHeaders["X-Request-Time"] = new Date().toISOString();

    // Log
    log("Processing request: " + request.URL);

    return myMiddleware.ReturnData(request, {});
});

Advanced Usage

API Versioning

{
  "definition": {
    "location": "header",
    "key": "x-api-version"
  },
  "version_data": {
    "not_versioned": false,
    "default_version": "v2",
    "versions": {
      "v1": {
        "name": "v1",
        "expires": "2027-01-01 00:00"
      },
      "v2": {
        "name": "v2"
      }
    }
  }
}

Load Balancing

{
  "proxy": {
    "enable_load_balancing": true,
    "target_list": [
      "http://backend1:3000",
      "http://backend2:3000",
      "http://backend3:3000"
    ]
  }
}

Circuit Breaker

{
  "version_data": {
    "versions": {
      "Default": {
        "use_extended_paths": true,
        "extended_paths": {
          "circuit_breakers": [
            {
              "path": "/api/*",
              "method": "GET",
              "threshold_percent": 0.5,
              "samples": 5,
              "return_to_service_after": 60
            }
          ]
        }
      }
    }
  }
}

Troubleshooting

IssueSolution
403 ForbiddenCheck API key validity; verify access rights include the API
404 after API createRun hot reload (/tyk/reload/group); check listen_path
Gateway won’t startVerify Redis connectivity; check tyk.conf JSON syntax
Rate limit not workingVerify key has rate limits set; check disable_rate_limit is false
Analytics missingEnable enable_analytics and enable_detailed_recording
Upstream timeoutIncrease proxy timeout settings; check backend health
JWT validation failsVerify JWKS URL is reachable; check signing method configuration
Hot reload failsCheck gateway secret is correct; review gateway logs