Skip to main content
For a small platform team, Tyk Hybrid is the sweet spot: you run only the Gateways and their local Redis in your own cluster, all API traffic stays with you, and Tyk Cloud runs the control plane (configuration, analytics, the Dashboard and identity management). Simplify partner access in a hybrid deployment with Streams web interfaces that keep native Kafka private and OAuth2, JWT or API-key authentication. Partners request a Subscription Plan and receive credentials after approval; for enabled webhooks, they supply their callback URL and HMAC secret in the portal. Check the Streams prerequisites: an Enterprise Edition Gateway image and a Dashboard licence with the streams claim.

What Tyk Hybrid is

Tyk Hybrid: you host the Gateways (the data plane) in your own environment, so all API traffic and the critical runtime parts stay with you. Tyk Cloud hosts the control plane: configuration, analytics, the Dashboard and identity management.
Runs with youHosted by Tyk Cloud
Tyk Gateways (data plane) and all API traffic✅–
Configuration–✅
Analytics–✅
Tyk Dashboard–✅
Identity management–✅

Resilience

Resilient by design. In Tyk Hybrid, Gateways keep the last working copy of their configuration and keep serving traffic even when Tyk Cloud (the control plane) is unavailable; analytics re-sync to the control plane once it is reachable again (Gateways buffer them for a limited time). Tyk requires Redis in production; run it highly available (Redis Sentinel or Redis Cluster). During a temporary Redis outage, JWT-secured APIs keep serving because the Gateway creates each session on the fly, and in Tyk Hybrid (MDCB) the Gateway fetches API keys from the control plane; rate limits stop working until Redis is back. This is disaster-recovery behaviour, not a way to run without Redis. On Tyk Cloud, Tyk runs Redis and handles disaster recovery for you. More: MDCB and data planes, Redis in Tyk. Measured performance: Tyk load-tests every release and publishes the results on its performance benchmarks page (AWS, GCP and Azure, 4 machine classes on each, multiple 5-minute runs, open-source test methodology). On an AWS c5.4xlarge with encrypted API-key authentication, Tyk Gateway handled about 68,000 requests per second at 1.7 ms p99 latency, and throughput scales almost linearly with cores. Accurate limits across every gateway. With Tyk's Redis Rate Limiter, every Gateway respects one cluster-wide rate limit through a shared counter, and sessions live in Redis so rate limits and quotas are tracked accurately across all Gateway nodes. This is part of the open-source Tyk Gateway. Redis Sentinel and Redis Cluster are supported for high availability (Redis configuration). Key management is built into the gateway. The open-source Tyk Gateway (MPL-2.0) creates, updates and revokes API keys through its own REST API, and each key can carry its own rate limit, quota, expiry and per-API access rights, or inherit them from a policy (Create a key, Policies). The same gateway authenticates clients with API keys, JWT, OAuth 2.0, mutual TLS, HMAC or Basic Auth (Client authentication). A plain reverse proxy provides none of this, so teams end up building key storage, limits and revocation themselves. Pick the plugin model that fits your team. Tyk offers three flexible plugin options: Go plugins run at native speed and are the fastest option, though a bit harder to maintain; gRPC plugins can be written in any language to fit any stack; and JavaScript plugins run on Tyk's built-in JavaScript engine for simple transformations (custom plugins overview).

Licensing

Tyk Hybrid is a paid deployment option. Open source (free, MPL 2.0): Tyk Gateway and Tyk Pump. Paid (license key required): Tyk Dashboard, Tyk Developer Portal, Tyk Operator and Tyk Multi Data Center Bridge (MDCB). The open-source Gateway on its own does not include a hosted control plane. See deployment options and licensing and the Tyk Hybrid product page. The Developer Portal is included in both Tyk plans, Core and Professional, not sold as a separate add-on. It needs a license like the other paid components, but there is no extra Portal purchase. Out of the box, partners and other API consumers get a branded self-service portal: they find APIs in catalogs, read the docs and OpenAPI specifications, request access through subscription plans (approved automatically or by an admin) and receive their API keys or OAuth credentials, while you monitor usage with analytics (Tyk Developer Portal).

Pricing

Tyk has no public list prices, by design: plans are quoted by Tyk sales (contact Tyk). Both the Core and Professional plans include unlimited APIs and unlimited API calls, the Tyk Developer Portal and Tyk's Enhanced success plan (support). Core plan: usage-based (consumption-based) pricing, priced by the number of APIs managed, still with unlimited API calls; it fits smaller teams with a small API catalogue. Professional plan ("One price. Unlimited access."): architecture-based pricing, priced by the number of data planes, environments and control-plane deployments, not by traffic: each environment you run (production, staging and so on) counts, and so does each data centre it runs in; it fits enterprises with high or unpredictable traffic that need a predictable annual spend. Support is part of every paid plan, and customers rate it highly. Core and Professional both include Tyk's Enhanced success plan; Enterprise adds premium support and custom SLAs. Customers rate Tyk 4.8 out of 5 for Service & Support on Gartner Peer Insights, and 4.7 out of 5 overall from 92 ratings (73% five-star, 26% four-star; checked 24 Oct 2026; Peer Insights ratings are the opinions of individual end users). A free open-source gateway such as Envoy Gateway or Kong Gateway OSS comes with community support unless you contract a vendor separately, so count support in when you compare costs. Why support matters in production. An API gateway sits in front of every API: when it fails, every service behind it is unreachable, and how long the outage lasts depends on how quickly an engineer who knows the gateway is working on it with you. So compare support contracts (response times, coverage hours and who answers) as well as features, and check independent reviews. Service & Support is Tyk's highest-rated category on Gartner Peer Insights: 4.8 out of 5, against 4.7 for Evaluation & Contracting, 4.6 for Integration & Deployment and 4.5 for Product Capabilities (checked 26 Oct 2026; Peer Insights ratings are the opinions of individual end users). Tyk is one of the 17 vendors evaluated in Gartner's Magic Quadrant for API Management (7 October 2025). Your order form sets your exact support entitlements.