---
title: "Deploy Tyk"
description: "API gateway with auth, rate limits, quotas and analytics"
category: "Other"
url: https://railway.com/deploy/tyk
---

# Deploy Tyk

API gateway with auth, rate limits, quotas and analytics

**[Deploy Tyk on Railway](https://railway.com/template/tyk)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/tyk/manifest.json

- **Creator:** A3A
- **Category:** Other
- **Total deploys:** 1

## Template content

### Redis https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/redis.svg

- **Image:** redis:8.2
- **Start command:** `/bin/sh -c "rm -rf $RAILWAY_VOLUME_MOUNT_PATH/lost+found/ && exec docker-entrypoint.sh redis-server --requirepass $REDIS_PASSWORD --save 60 1 --dir $RAILWAY_VOLUME_MOUNT_PATH"`

### tyk-pump https://cdn.worldvectorlogo.com/logos/tyk-1.svg

- **Image:** tykio/tyk-pump-docker-pub:v1.17
- **Health check:** /health

### Postgres https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### tyk-gateway https://cdn.worldvectorlogo.com/logos/tyk-1.svg

- **Source:** https://github.com/gridalpha/tyk-railway
- **Health check:** /ready
- **Public domain:** Yes

## Documentation

# Deploy and Host Tyk on Railway

Tyk is an open-source API gateway written in Go that sits in front of your services and handles what every API needs but no team wants to build twice: authentication, rate limiting, quotas, request and response transformation, versioning, caching and per-consumer analytics. It is licensed under MPL-2.0, so there is no request cap, no seat count and no licence key. Teams reach for it when internal services need one front door with real access control, or when a public API needs metered keys handed to consumers.

This template lets you self-host Tyk on Railway with the pieces the project documents for production already wired together. The **tyk-gateway** service is the only one with a public domain: it terminates your traffic, proxies it to the upstreams you configure, and serves Tyk's REST Admin API on the same host behind a generated secret. **Redis** is mandatory rather than optional — it holds API keys, quota counters, the rate limiter and the buffer of request records. **tyk-pump** drains that buffer every ten seconds into **Postgres**, where analytics survive restarts in the `tyk_analytics`, `tyk_aggregated` and `tyk_uptime_analytics` tables. A volume keeps API definitions and policies across redeploys.

![Tyk gateway, pump, Redis and Postgres services on Railway](https://res.cloudinary.com/rroe4rtk/image/upload/v1788970710/tyk-architecture.png)

## Getting Started with Tyk on Railway

The open-source gateway has no web UI and no user accounts, so there is no first-run wizard and nothing to register. Everything runs through its REST Admin API, and the one credential is `TYK_GW_SECRET`, generated for you and visible in the tyk-gateway service's variables. Start by opening `https://your-domain.up.railway.app/hello`: a healthy deployment answers `"status": "pass"` with a `redis` entry that is also passing.

Then publish your first API. This creates a keyless route at `/httpbin/` and hot-reloads the gateway:

```
API='{"name":"HTTPBin Demo","api_id":"httpbin-demo","org_id":"default",
 "use_keyless":true,"active":true,
 "version_data":{"not_versioned":true,"versions":{"Default":{"name":"Default"}}},
 "proxy":{"listen_path":"/httpbin/","target_url":"https://httpbin.org","strip_listen_path":true}}'

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" -d "$API" \
  https://your-domain.up.railway.app/tyk/apis

curl -H "X-Tyk-Authorization: $TYK_GW_SECRET" \
  https://your-domain.up.railway.app/tyk/reload/group
```

A `GET` on `/httpbin/get` now returns the upstream's response. To protect an API instead, set `use_keyless` to false with `"auth":{"auth_header_name":"Authorization"}`, `POST` a policy to `/tyk/policies` carrying a `rate`, a `per` window and a `quota_max`, then `POST` to `/tyk/keys/create` with `{"apply_policies":["your-policy-id"]}`. That response holds the key your consumer sends: calls without it are 401, calls past the rate are 429, and every request reaches Postgres within seconds.

![Tyk Gateway health endpoint reporting a passing Redis connection](https://res.cloudinary.com/rroe4rtk/image/upload/v1788970711/tyk-gateway-health.png)
![Tyk policy setting a three-per-minute rate limit and quota](https://res.cloudinary.com/rroe4rtk/image/upload/v1788970714/tyk-rate-limit-policy.png)
![Upstream JSON document returned through a Tyk listen path](https://res.cloudinary.com/rroe4rtk/image/upload/v1788970717/tyk-proxied-upstream.png)

## About Hosting Tyk

A gateway is the one component you cannot afford to have somebody else rate-limit for you, which is why Tyk's core is self-hostable in full. It is a single Go binary, and scaling out means more copies against the same Redis, since keys, quotas and the limiter live there, not in process memory.

- Auth: bearer tokens, JWT with JWKS, HMAC, OAuth 2.0, mTLS and Open Policy Agent
- Per-key and per-policy rate limits, quotas and throttling, shared across replicas
- REST, GraphQL, gRPC, TCP and SSE upstreams, caching and circuit breakers
- Request and response transformation, URL rewriting and virtual endpoints
- Custom middleware in JavaScript, Go, Python or gRPC plugins

Tyk also sells a Dashboard, a Developer Portal and a multi-data-centre control plane; those are commercially licensed and not part of the open-source gateway. Managing this deployment means the Admin API, or `tyk-sync`, which applies definitions and policies from a Git repository.

## Why Deploy Tyk on Railway

Railway removes the infrastructure work self-hosting a gateway normally implies.

- Redis, Postgres and the analytics pump are provisioned and wired on deploy
- Private networking keeps Redis, Postgres and the pump off the internet
- A volume holds API definitions and policies through redeploys
- Health checks watch the gateway's readiness route, not just the process

## Common Use Cases

- **One front door for internal services.** Route `/billing/`, `/search/` and `/notifications/` to services with no public address of their own.
- **A metered public API.** Issue a key per customer, attach a policy with a monthly quota, read consumption out of Postgres.
- **Retrofitting auth onto a legacy backend.** Terminate JWT or mTLS at the gateway and forward plain requests to an app that has none.
- **Protecting model endpoints.** Cap spend with per-key quotas and cache repeated responses before they reach a costly upstream.

## Dependencies for Tyk

- **tyk-gateway** — built from [tyk-railway](https://github.com/gridalpha/tyk-railway), which packages `tykio/tyk-gateway:v5.15` so it can write to a Railway volume.
- **Redis** (`redis:8.2`) — keys, quota counters, rate limiter and analytics buffer. Not optional: the gateway needs it to start.
- **tyk-pump** (`tykio/tyk-pump-docker-pub:v1.17`) — moves buffered records out of Redis into long-term storage.
- **Postgres** (`postgres-ssl:18`) — analytics tables, created by the pump on first run.

### Environment Variables Reference

| Variable | Service | Purpose |
|---|---|---|
| `TYK_GW_SECRET` | tyk-gateway | Credential for every `/tyk/*` Admin API call |
| `TYK_GW_STORAGE_HOST` | tyk-gateway | Redis host, referenced from the Redis service |
| `TYK_GW_ENABLEANALYTICS` | tyk-gateway | Records requests for the pump to drain |
| `TYK_PMP_PURGEDELAY` | tyk-pump | Seconds between drains of the Redis buffer |

Every config-file setting has an environment-variable form: `TYK_GW_` for the gateway, `TYK_PMP_` for the pump.

### Deployment Dependencies

- Source and images: [TykTechnologies/tyk](https://github.com/TykTechnologies/tyk), [tykio/tyk-gateway](https://hub.docker.com/r/tykio/tyk-gateway), [tykio/tyk-pump-docker-pub](https://hub.docker.com/r/tykio/tyk-pump-docker-pub)
- Configuration and Admin API reference: [tyk.io/docs](https://tyk.io/docs/tyk-oss-gateway/configuration/)

## Hardware Requirements for Self-Hosting Tyk

| Resource | Minimum | Recommended |
|---|---|---|
| CPU | 1 vCPU | 2+ vCPU per gateway replica |
| RAM | 512 MB | 1–2 GB, plus Redis headroom |
| Storage | 1 GB volume | 5 GB, plus Postgres analytics growth |
| Runtime | Go binary, Redis 6+ | Redis 8, Postgres 14+ |

## Self-Hosting Tyk with Docker

The gateway needs nothing but Redis to start. Locally that is two containers:

```
docker run -d --name tyk-redis --network tyk redis:8.2

docker run -d --name tyk-gateway --network tyk -p 8080:8080 \
  -e TYK_GW_SECRET=change-me \
  -e TYK_GW_STORAGE_HOST=tyk-redis \
  -e TYK_GW_LISTENPORT=8080 \
  tykio/tyk-gateway:v5.15
```

Persistent analytics means adding the pump and a database:

```
docker run -d --name tyk-pump --network tyk \
  -e TYK_PMP_OMITCONFIGFILE=true \
  -e TYK_PMP_ANALYTICSSTORAGECONFIG_HOST=tyk-redis \
  -e TYK_PMP_PUMPS_SQL_TYPE=sql -e TYK_PMP_PUMPS_SQL_META_TYPE=postgres \
  -e TYK_PMP_PUMPS_SQL_META_CONNECTIONSTRING="$DSN" \
  -e TYK_PMP_UPTIMEPUMPCONFIG_UPTIMETYPE=sql \
  -e TYK_PMP_UPTIMEPUMPCONFIG_TYPE=postgres \
  -e TYK_PMP_UPTIMEPUMPCONFIG_CONNECTIONSTRING="$DSN" \
  tykio/tyk-pump-docker-pub:v1.17
```

The last two variables matter: the pump's uptime writer defaults to MongoDB and exits at startup without a connection string, even when every other pump is SQL.

## Is Tyk Free to Self-Host?

The Tyk Gateway and Tyk Pump are free and open source under MPL-2.0, with no request limits, no key limits and no licence key to obtain. The Dashboard, the Developer Portal and multi-data-centre bridging are separately licensed and quoted by the vendor; none is required to run the gateway. On Railway you pay only for what the four services use.

## FAQ

**What is Tyk?**
Tyk is an open-source API gateway and management platform. It sits between clients and your services, authenticating callers, enforcing rate limits and quotas, transforming requests, and recording analytics per call.

**What does this Railway template deploy?**
Four services: the Tyk Gateway on a public domain with a volume for its API definitions and policies, Redis, Tyk Pump, and Postgres for analytics. The last three stay on the private network.

**Why does Tyk need Redis?**
Redis holds API keys, quota counters, OAuth tokens and the distributed rate limiter, so every replica enforces the same limits, and it buffers analytics until the pump drains them.

**How do I add an API to a self-hosted Tyk gateway without the Dashboard?**
Send an API definition to `POST /tyk/apis` with the `X-Tyk-Authorization` header, then call `/tyk/reload/group` so it takes effect without a restart. `tyk-sync` does the same from a Git repository.

**How do I secure the Tyk Admin API?**
It is gated by `TYK_GW_SECRET`, generated at deploy time; rotate it by changing that variable. To remove remote admin access entirely, set `TYK_GW_CONTROLAPIPORT` and `/tyk/*` moves to an unpublished port.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/tyk