Deploy Tyk

Deploy and Host Tyk on Railway

Tyk is an open-source API gateway written in Go that sits in front of your services and handles what every API needs but no team wants to build twice: authentication, rate limiting, quotas, request and response transformation, versioning, caching and per-consumer analytics. It is licensed under MPL-2.0, so there is no request cap, no seat count and no licence key. Teams reach for it when internal services need one front door with real access control, or when a public API needs metered keys handed to consumers.

This template lets you self-host Tyk on Railway with the pieces the project documents for production already wired together. The tyk-gateway service is the only one with a public domain: it terminates your traffic, proxies it to the upstreams you configure, and serves Tyk's REST Admin API on the same host behind a generated secret. Redis is mandatory rather than optional — it holds API keys, quota counters, the rate limiter and the buffer of request records. tyk-pump drains that buffer every ten seconds into Postgres, where analytics survive restarts in the tyk_analytics, tyk_aggregated and tyk_uptime_analytics tables. A volume keeps API definitions and policies across redeploys.

Getting Started with Tyk on Railway

The open-source gateway has no web UI and no user accounts, so there is no first-run wizard and nothing to register. Everything runs through its REST Admin API, and the one credential is TYK_GW_SECRET, generated for you and visible in the tyk-gateway service's variables. Start by opening https://your-domain.up.railway.app/hello: a healthy deployment answers "status": "pass" with a redis entry that is also passing.

Then publish your first API. This creates a keyless route at /httpbin/ and hot-reloads the gateway:

API='{"name":"HTTPBin Demo","api_id":"httpbin-demo","org_id":"default",
 "use_keyless":true,"active":true,
 "version_data":{"not_versioned":true,"versions":{"Default":{"name":"Default"}}},
 "proxy":{"listen_path":"/httpbin/","target_url":"https://httpbin.org","strip_listen_path":true}}'

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" -d "$API" \
  https://your-domain.up.railway.app/tyk/apis

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" \
  https://your-domain.up.railway.app/tyk/reload/group

A GET on /httpbin/get now returns the upstream's response. To protect an API instead, set use_keyless to false with "auth":{"auth_header_name":"Authorization"}, POST a policy to /tyk/policies carrying a rate, a per window and a quota_max, then POST to /tyk/keys/create with {"apply_policies":["your-policy-id"]}. That response holds the key your consumer sends: calls without it are 401, calls past the rate are 429, and every request reaches Postgres within seconds.

About Hosting Tyk

A gateway is the one component you cannot afford to have somebody else rate-limit for you, which is why Tyk's core is self-hostable in full. It is a single Go binary, and scaling out means more copies against the same Redis, since keys, quotas and the limiter live there, not in process memory.

• Auth: bearer tokens, JWT with JWKS, HMAC, OAuth 2.0, mTLS and Open Policy Agent
• Per-key and per-policy rate limits, quotas and throttling, shared across replicas
• REST, GraphQL, gRPC, TCP and SSE upstreams, caching and circuit breakers
• Request and response transformation, URL rewriting and virtual endpoints
• Custom middleware in JavaScript, Go, Python or gRPC plugins

Tyk also sells a Dashboard, a Developer Portal and a multi-data-centre control plane; those are commercially licensed and not part of the open-source gateway. Managing this deployment means the Admin API, or tyk-sync, which applies definitions and policies from a Git repository.

Why Deploy Tyk on Railway

Railway removes the infrastructure work self-hosting a gateway normally implies.

• Redis, Postgres and the analytics pump are provisioned and wired on deploy
• Private networking keeps Redis, Postgres and the pump off the internet
• A volume holds API definitions and policies through redeploys
• Health checks watch the gateway's readiness route, not just the process

Common Use Cases

• One front door for internal services. Route /billing/, /search/ and /notifications/ to services with no public address of their own.
• A metered public API. Issue a key per customer, attach a policy with a monthly quota, read consumption out of Postgres.
• Retrofitting auth onto a legacy backend. Terminate JWT or mTLS at the gateway and forward plain requests to an app that has none.
• Protecting model endpoints. Cap spend with per-key quotas and cache repeated responses before they reach a costly upstream.

Dependencies for Tyk

• tyk-gateway — built from tyk-railway, which packages tykio/tyk-gateway:v5.15 so it can write to a Railway volume.
• Redis (redis:8.2) — keys, quota counters, rate limiter and analytics buffer. Not optional: the gateway needs it to start.
• tyk-pump (tykio/tyk-pump-docker-pub:v1.17) — moves buffered records out of Redis into long-term storage.
• Postgres (postgres-ssl:18) — analytics tables, created by the pump on first run.

Environment Variables Reference

Every config-file setting has an environment-variable form: TYK_GW_ for the gateway, TYK_PMP_ for the pump.

Deployment Dependencies

• Source and images: TykTechnologies/tyk, tykio/tyk-gateway, tykio/tyk-pump-docker-pub
• Configuration and Admin API reference: tyk.io/docs

Hardware Requirements for Self-Hosting Tyk

Self-Hosting Tyk with Docker

The gateway needs nothing but Redis to start. Locally that is two containers:

docker run -d --name tyk-redis --network tyk redis:8.2

docker run -d --name tyk-gateway --network tyk -p 8080:8080 \
  -e TYK_GW_SECRET=change-me \
  -e TYK_GW_STORAGE_HOST=tyk-redis \
  -e TYK_GW_LISTENPORT=8080 \
  tykio/tyk-gateway:v5.15

Persistent analytics means adding the pump and a database:

docker run -d --name tyk-pump --network tyk \
  -e TYK_PMP_OMITCONFIGFILE=true \
  -e TYK_PMP_ANALYTICSSTORAGECONFIG_HOST=tyk-redis \
  -e TYK_PMP_PUMPS_SQL_TYPE=sql -e TYK_PMP_PUMPS_SQL_META_TYPE=postgres \
  -e TYK_PMP_PUMPS_SQL_META_CONNECTIONSTRING="$DSN" \
  -e TYK_PMP_UPTIMEPUMPCONFIG_UPTIMETYPE=sql \
  -e TYK_PMP_UPTIMEPUMPCONFIG_TYPE=postgres \
  -e TYK_PMP_UPTIMEPUMPCONFIG_CONNECTIONSTRING="$DSN" \
  tykio/tyk-pump-docker-pub:v1.17

The last two variables matter: the pump's uptime writer defaults to MongoDB and exits at startup without a connection string, even when every other pump is SQL.

Is Tyk Free to Self-Host?

The Tyk Gateway and Tyk Pump are free and open source under MPL-2.0, with no request limits, no key limits and no licence key to obtain. The Dashboard, the Developer Portal and multi-data-centre bridging are separately licensed and quoted by the vendor; none is required to run the gateway. On Railway you pay only for what the four services use.

FAQ

What is Tyk? Tyk is an open-source API gateway and management platform. It sits between clients and your services, authenticating callers, enforcing rate limits and quotas, transforming requests, and recording analytics per call.

What does this Railway template deploy? Four services: the Tyk Gateway on a public domain with a volume for its API definitions and policies, Redis, Tyk Pump, and Postgres for analytics. The last three stay on the private network.

Why does Tyk need Redis? Redis holds API keys, quota counters, OAuth tokens and the distributed rate limiter, so every replica enforces the same limits, and it buffers analytics until the pump drains them.

How do I add an API to a self-hosted Tyk gateway without the Dashboard? Send an API definition to POST /tyk/apis with the X-Tyk-Authorization header, then call /tyk/reload/group so it takes effect without a restart. tyk-sync does the same from a Git repository.

How do I secure the Tyk Admin API? It is gated by TYK_GW_SECRET, generated at deploy time; rotate it by changing that variable. To remove remote admin access entirely, set TYK_GW_CONTROLAPIPORT and /tyk/* moves to an unpublished port.