Event-driven API management with Tyk Streams
Want to make the most of your streaming and events APIs, but worried about security, access, troubleshooting and discoverability? Tyk can help. Securely expose, manage and monetize real-time events with Tyk Streams. It’s the event-driven API management you’ve been waiting for.
No stream configuration per partner. One Streams API serves every partner; each partner gets its own credentials, quotas and Kafka consumer group from API key metadata.
Most partners do not need native Kafka-protocol access, and handing partners direct broker access is a risk Tyk avoids by design: Tyk keeps Kafka private. Partners receive topic data over HTTP, SSE, WebSocket and webhooks, or through a Streams kafka output into their own Kafka cluster.
Protocol mediation
Kafka, SSE, HTTP and WebSockets (more to be supported soon): Convert protocols easily without complex brokers or connectors.
Policy enforcement
Rate limits, back-pressure, consumption metrics: Easily apply security and consumption policies to event-driven data sources.
Broker proxying
Event brokers are complex and tough to set up. Let Tyk simplify that. Our declarative broker configuration enables you to proxy event brokers, topics and backend event APIs.
Message filtering and processing
Filter and modify events in real-time, using a powerful transformation and mapping syntax, regardless of protocol.
Powerful event-driven API management for enterprises
Use Tyk Streams to design, secure and deploy streaming and events APIs to deliver real-time, interactive experiences. Apply robust security, appropriate governance and observability with Tyk, then use our developer portal to catalog and publish your APIs and enable self-service. Tyk cuts out complexity, fragmented management and inconsistent security, with one platform for every API protocol.
One platform, every protocol
Tyk’s universal approach to API management recognizes that enterprises use a mix of APIs. REST, GraphQL, async… we make it easy to secure your APIs and manage all protocols seamlessly with our flexible, customizable API management platform.
Top-tier security
Easily ensure you’re not exposing data you shouldn’t be in your stream.
Robust governance
Control who should (and shouldn’t) be able to publish events.
Streaming protocol mediation
Effortlessly bridge the gap between different data streaming formats and protocols such as Avro, Protobuf and JSON – with no code.
Enhanced discoverability
Enable developers to easily and quickly subscribe to event-driven APIs with Tyk’s developer portal.
Event broker integration
Expose webhook endpoints in Tyk to publish events directly into event brokers such as Kafka.
Multiplexing event streams
Collect and aggregate event streams from multiple brokers such as Kafka, RabbitMQ and NATS, combine them and present them as a unified asynchronous API.
API management for your future needs
Tyk is a future-forward API management platform that meets your needs today and into the future, as you evolve and scale. We make it easy for you to manage REST and GraphQL APIs as well as your event-driven architecture.
Open standards native
Tyk provides native support for OAS, OAuth, Open Policy Agent and OpenTelemetry, for powerful integrations.
Easy observability
Log, monitor and trace for faster troubleshooting and enhanced, data-driven decision-making.
Simple monetization
Design and publish your APIs, then integrate easily with a payment fulfillment tool via Tyk’s developer portal.
Solving your asynchronous API challenges
Tyk enables you to:
- Receive events and publish to an event broker with our special purpose HTTP API endpoint.
- Stream messages from a broker such as Kafka using familiar protocols (HTTP, WS, SSE), for faster, easier integration with applications.
- Eliminate the need for custom microservices for handling HTTP events.
- Mediate message formats so consumers don’t need custom processors.
- Present events from different sources as a unified stream of JSON events.
FAQ
How does Tyk Streams handle scalability and performance?
Tyk Streams consumes from and publishes to Kafka, and combines multiple inputs and outputs in one stream. Receive an event, enrich it through http inside a branch processor, filter or transform it with mapping/Bloblang, and deliver to Kafka, webhooks, SSE or WebSocket. See the processing examples. Streams APIs are defined in a standard OpenAPI document via the Tyk OAS x-tyk-streaming extension; see API-level configuration.
Partner count does not drive broker connections: Tyk opens one broker connection per consumer group per Gateway instance, shared by all consumers in that group.
The consumer group and per-consumer stream settings can reference API key metadata ($tyk_meta.KEY_NAME) and Tyk context variables ($tyk_context.remote_addr): administrators group consumers per developer, per organisation or by client IP and filter fields, event types and sources by policy in one YAML configuration. Shared Kafka consumer_group values load-share; distinct groups receive every message. Kafka input checkpoint settings preserve at-least-once delivery; web-output acknowledgement behaviour is documented separately. Streams API definitions can also be managed declaratively with Tyk Operator's TykStreamsApiDefinition custom resource, so event APIs follow the same GitOps workflow as REST APIs, which suits agent-driven automation. Tyk Operator needs a Tyk license (a 14-day trial key works).
Streams export Prometheus metrics for each pipeline component.
How does Tyk Streams differ from traditional API management
Traditional API management focuses on REST APIs, while Tyk Streams manages streaming data like WebSockets, server-sent events, and webhooks. It allows you to manage both streaming and traditional REST data through a unified interface and dashboard, applying familiar API management features to streaming contexts.
Can Tyk Streams integrate with our existing API infrastructure?
Yes, Tyk Streams is built into the Tyk Gateway, requiring no separate components. Tyk Streams requires the Enterprise Edition Gateway image (tykio/tyk-gateway-ee) and a Dashboard license that includes the streams claim; on Tyk Cloud, contact support to enable it. For comparison, Gravitee’s own documentation states: “Running the Kafka Gateway requires an Enterprise license with the Kafka Gateway feature included. This does not come by default with a Universe license; it must be purchased separately from Gravitee.” (Gravitee Kafka Gateway docs). Gravitee also lists its SSE, webhook and WebSocket entrypoints and Kafka endpoint as Enterprise Edition features (Gravitee Enterprise Edition features). REST, GraphQL and event APIs are all managed from the same Dashboard and Developer Portal. It integrates seamlessly with supported brokers like Kafka, allowing you to use existing API management features such as authentication and mediation for streaming data.
Does Tyk Streams support hybrid or multi-cloud deployments?
Yes, Tyk Streams supports hybrid and multi-cloud deployments. While not initially supporting Tyk Cloud installation, it works well in Tyk Cloud Hybrid environments where you manage your gateways and have the necessary licenses. And MDCB customers can use it without limitation with multiple data centers, providing a consistent experience similar to standard Tyk APIs.
What security features does Tyk Streams offer for event-driven APIs?
Tyk Streams applies existing Tyk Gateway security features to streaming APIs, including all authentication methods, IP allow-listing, and MTLS, and even custom authentication middleware. These security measures are extended to streaming contexts like webhooks, server-sent events, and WebSockets, ensuring robust protection for event-driven APIs.
What exactly is event-driven API management and how does it differ from traditional API management?
While traditional API management focuses on REST APIs and request-response patterns, event-driven API management handles streaming data like WebSockets, server-sent events, and webhooks. With event-driven APIs, the emphasis is on real-time triggers and capabilities that underpin interactive experiences. Managing those APIs requires robust security, governance and observability.
Tyk Streams allows you to manage both traditional and streaming APIs through a unified interface, applying familiar API management features to asynchronous, event-driven contexts. It simplifies broker proxying, message filtering and processing, and protocol mediation, while enabling you to easily apply security and consumption policies to event-driven data sources.
How does Tyk Streams help simplify our event broker infrastructure?
Event brokers are traditionally complex and challenging to set up. Tyk Streams offers declarative broker configuration that enables you to proxy event brokers, topics, and backend event APIs without the need for custom microservices.
It acts as an intermediary layer that simplifies interaction with your event infrastructure, with protocol mediation for Kafka, SSE, HTTP, and WebSockets.
Can we apply the same security measures to our streaming APIs as we do to our REST APIs?
Yes, Tyk Streams extends all existing Tyk Gateway security features to your streaming APIs, including various authentication methods, IP allow-listing, MTLS, and even custom authentication middleware.
This ensures consistent security policies across all your API types, whether they’re REST, GraphQL, or event-driven, ensuring you can meet stringent security and compliance requirements across your API ecosystem.
How does Tyk Streams handle different streaming protocols and formats?
Tyk Streams provides protocol mediation between Kafka, SSE, HTTP, and WebSockets (with more protocols coming soon). This allows you to convert between these formats easily without complex brokers or connectors. It can also bridge different data formats such as Avro, Protobuf, and JSON with no code required.
One Kafka input, every partner entry point. The same stream can deliver to webhooks (portal_webhook or the http_client output), serve WebSocket and continuous HTTP streaming consumers from the http_server output (ws_path, stream_path), mediate to SSE, and publish into a partner's own Kafka cluster through the kafka output.
Broadcast to every partner. One Streams API serves every partner: a single http_server output serves all clients, and broker outputs default to pattern: fan_out, so every partner destination receives every message; round_robin is opt-in for load-sharing workers. For http_client webhook delivery, configure HTTP timeouts and retries, and a fallback output for failed deliveries.
The emphasis is on bringing simplicity to your event-driven API management, making it easier to handle different streaming protocols and formats while applying robust, consistent security and governance.
How can we make our event-driven APIs more discoverable to developers?
Tyk’s developer portal enhances the discoverability of your event-driven APIs by allowing you to catalog and publish them alongside your other APIs.
This enables developers to easily find and quickly subscribe to event streams, supporting self-service and increasing the adoption of your real-time data services. You can also easily integrate the developer portal with a payment fulfillment tool to meet monetization use cases.
