Tyk Edge Gateway Environment Variables

Environment variables and configuration options for Tyk Edge Gateway.

This page details the environment variables that can be used to configure the Tyk Edge Gateway.

The Edge Gateway binary, its Helm values, and its container images use the older name microgateway (for example ./microgateway, the microgateway.enabled Helm value, and the tykio/tyk-microgateway-ent image). These docs use “Edge Gateway” for the same component.

Configuration

Tyk Edge Gateway (Edge Gateway) is configured primarily using environment variables.

Configuration Precedence

The application loads configuration in the following order of precedence (highest to lowest):

1. Shell Environment Variables: Variables set in the OS/Shell (e.g., export PORT=9090) always override everything else.
2. .env File: Variables loaded from the file specified by the -env flag.
   • Note: The application checks if a variable is already set in the environment before loading it from the file, ensuring shell variables are preserved.

Command Line Flags

You can specify a .env file using the -env flag when starting the binary:

./microgateway -env /path/to/prod.env

Supported Formats

• Main Configuration: Only the .env format (key=value pairs) is supported via the -env flag.
• Plugin Configuration: Supports JSON and YAML files for plugin definitions, specified via the PLUGINS_CONFIG_PATH environment variable.

Environment Variable Type Mapping

When configuring Tyk components using environment variables, it’s important to understand how different data types are represented. The type of each variable is based on its definition in the Go source code. This section provides a guide on how to format values for common data types.

Go Type	Environment Variable Format	Example
string	A regular string of text.	TYK_GW_SECRET="mysecret"
int, int64	A whole number.	TYK_GW_LISTENPORT=8080
bool	true or false.	TYK_GW_USEDBAPPCONFIG=true
[]string	A comma-separated list of strings.	TYK_PMP_PUMPS_STDOUT_FILTERS_SKIPPEDAPIIDS="api1,api2,api3"
map[string]string	A comma-separated list of key:value pairs.	TYK_GW_GLOBALHEADERS="X-Tyk-Test:true,X-Tyk-Version:1.0"
map[string]interface{}	A JSON string representing the object.	TYK_GW_POLICIES_POLICYSOURCE_CONFIG='{"connection_string": "..."}'

For complex types like map[string]interface{}, the value should be a valid JSON string. For []string and map[string]string, ensure there are no spaces around the commas unless they are part of the value itself.

Variables

From v2.2.0, ENABLE_RATE_LIMITING, GATEWAY_DEFAULT_RATE_LIMIT, and the --rate-limit flags are removed. These settings had no effect in earlier versions. To limit request rates, use a rate limiting plugin.

PORT

ENV: PORT
Type: integer
Default: 8080

The port for the server to listen on.

HOST

ENV: HOST
Type: string
Default: 0.0.0.0

The host for the server to bind to.

TLS_ENABLED

ENV: TLS_ENABLED
Type: boolean
Default: false

Enable TLS.

TLS_CERT_PATH

ENV: TLS_CERT_PATH
Type: string

The path to the TLS certificate file.

TLS_KEY_PATH

ENV: TLS_KEY_PATH
Type: string

The path to the TLS key file.

READ_TIMEOUT

ENV: READ_TIMEOUT
Type: string
Default: 300s

The read timeout for the server.

WRITE_TIMEOUT

ENV: WRITE_TIMEOUT
Type: string
Default: 300s

The write timeout for the server.

IDLE_TIMEOUT

ENV: IDLE_TIMEOUT
Type: string
Default: 120s

The idle timeout for the server.

SHUTDOWN_TIMEOUT

ENV: SHUTDOWN_TIMEOUT
Type: string
Default: 30s

The shutdown timeout for the server.

DATABASE_TYPE

ENV: DATABASE_TYPE
Type: string
Default: sqlite

The type of database to use (sqlite or postgres).

DATABASE_DSN

ENV: DATABASE_DSN
Type: string
Default: file:./data/microgateway.db?cache=shared&mode=rwc

The database connection string.

DB_MAX_OPEN_CONNS

ENV: DB_MAX_OPEN_CONNS
Type: integer
Default: 25

The maximum number of open database connections.

DB_MAX_IDLE_CONNS

ENV: DB_MAX_IDLE_CONNS
Type: integer
Default: 25

The maximum number of idle database connections.

DB_CONN_MAX_LIFETIME

ENV: DB_CONN_MAX_LIFETIME
Type: string
Default: 5m

The maximum lifetime of a database connection.

DB_AUTO_MIGRATE

ENV: DB_AUTO_MIGRATE
Type: boolean
Default: true

Enable automatic database migrations.

DB_LOG_LEVEL

ENV: DB_LOG_LEVEL
Type: string
Default: warn

The log level for the database.

CACHE_ENABLED

ENV: CACHE_ENABLED
Type: boolean
Default: true

Enable caching.

CACHE_MAX_SIZE

ENV: CACHE_MAX_SIZE
Type: integer
Default: 1000

The maximum size of the cache.

CACHE_TTL

ENV: CACHE_TTL
Type: string
Default: 1h

The time-to-live for cache entries.

CACHE_CLEANUP_INTERVAL

ENV: CACHE_CLEANUP_INTERVAL
Type: string
Default: 10m

The cleanup interval for the cache.

CACHE_PERSIST_TO_DB

ENV: CACHE_PERSIST_TO_DB
Type: boolean
Default: false

Persist the cache to the database.

GATEWAY_TIMEOUT

ENV: GATEWAY_TIMEOUT
Type: string
Default: 30s

The timeout for the gateway.

GATEWAY_MAX_REQUEST_SIZE

ENV: GATEWAY_MAX_REQUEST_SIZE
Type: integer
Default: 10485760

The maximum request size for the gateway.

GATEWAY_MAX_RESPONSE_SIZE

ENV: GATEWAY_MAX_RESPONSE_SIZE
Type: integer
Default: 52428800

The maximum response size for the gateway.

GATEWAY_ENABLE_FILTERS

ENV: GATEWAY_ENABLE_FILTERS
Type: boolean
Default: true

Enable filters in the gateway.

GATEWAY_ENABLE_ANALYTICS

ENV: GATEWAY_ENABLE_ANALYTICS
Type: boolean
Default: true

Enable analytics in the gateway.

ANALYTICS_ENABLED

ENV: ANALYTICS_ENABLED
Type: boolean
Default: true

Enable analytics.

ANALYTICS_BUFFER_SIZE

ENV: ANALYTICS_BUFFER_SIZE
Type: integer
Default: 1000

The buffer size for analytics.

ANALYTICS_FLUSH_INTERVAL

ENV: ANALYTICS_FLUSH_INTERVAL
Type: string
Default: 10s

The flush interval for analytics.

ANALYTICS_RETENTION_DAYS

ENV: ANALYTICS_RETENTION_DAYS
Type: integer
Default: 7 when the analytics pulse is on, otherwise 90

The retention period for analytics in days. From v2.2.0, the Edge Gateway deletes older analytics rows in small batches.

ANALYTICS_REALTIME

ENV: ANALYTICS_REALTIME
Type: boolean
Default: false

Enable real-time analytics.

JWT_SECRET

ENV: JWT_SECRET
Type: string
Default: change-me-in-production

The secret key for JWTs.

ENCRYPTION_KEY

ENV: ENCRYPTION_KEY
Type: string
Default: change-me-in-production

The encryption key.

BCRYPT_COST

ENV: BCRYPT_COST
Type: integer
Default: 10

The cost factor for bcrypt.

TOKEN_LENGTH

ENV: TOKEN_LENGTH
Type: integer
Default: 32

The length of generated tokens.

SESSION_TIMEOUT

ENV: SESSION_TIMEOUT
Type: string
Default: 24h

The timeout for sessions.

ENABLE_IP_WHITELIST

ENV: ENABLE_IP_WHITELIST
Type: boolean
Default: false

Enable IP whitelisting.

LOG_LEVEL

ENV: LOG_LEVEL
Type: string
Default: info

The log level.

LOG_FORMAT

ENV: LOG_FORMAT
Type: string
Default: text

The log format (json or text).

ENABLE_METRICS

ENV: ENABLE_METRICS
Type: boolean
Default: true

Enable metrics. From v2.2.0, the Edge Gateway serves /metrics only when you also set METRICS_AUTH_TOKEN or METRICS_ALLOW_UNAUTHENTICATED.

METRICS_PATH

ENV: METRICS_PATH
Type: string
Default: /metrics

The path for metrics. From v2.2.0, the Edge Gateway uses this value. Earlier versions ignored it.

ENABLE_TRACING

ENV: ENABLE_TRACING
Type: boolean
Default: false

Enable tracing.

TRACING_ENDPOINT

ENV: TRACING_ENDPOINT
Type: string

The endpoint for tracing.

ENABLE_PROFILING

ENV: ENABLE_PROFILING
Type: boolean
Default: false

Enable profiling.

GATEWAY_MODE

ENV: GATEWAY_MODE
Type: string
Default: standalone

The gateway mode (standalone or edge).

CONTROL_ENDPOINT

ENV: CONTROL_ENDPOINT
Type: string

The gRPC endpoint of the control plane.

EDGE_ID

ENV: EDGE_ID
Type: string

A unique ID for the edge gateway.

EDGE_NAMESPACE

ENV: EDGE_NAMESPACE
Type: string

The namespace for the edge gateway.

EDGE_RECONNECT_INTERVAL

ENV: EDGE_RECONNECT_INTERVAL
Type: string
Default: 5s

The interval to wait before reconnecting to the control plane.

EDGE_HEARTBEAT_INTERVAL

ENV: EDGE_HEARTBEAT_INTERVAL
Type: string
Default: 30s

The interval for sending heartbeats to the control plane.

EDGE_SYNC_TIMEOUT

ENV: EDGE_SYNC_TIMEOUT
Type: string
Default: 10s

The timeout for syncing configuration from the control plane.

EDGE_AUTH_TOKEN

ENV: EDGE_AUTH_TOKEN
Type: string

The authentication token for connecting to the control plane.

EDGE_TLS_ENABLED

ENV: EDGE_TLS_ENABLED
Type: boolean
Default: true

Enable TLS for the connection to the control plane.

EDGE_TLS_CERT_PATH

ENV: EDGE_TLS_CERT_PATH
Type: string

The path to the client TLS certificate file.

EDGE_TLS_KEY_PATH

ENV: EDGE_TLS_KEY_PATH
Type: string

The path to the client TLS key file.

EDGE_TLS_CA_PATH

ENV: EDGE_TLS_CA_PATH
Type: string

The path to the CA certificate file for verifying the control plane’s certificate. From v2.2.1, the Edge Gateway loads this file and uses it instead of the system root certificates. Earlier versions checked only that the file existed.

EDGE_SKIP_TLS_VERIFY

ENV: EDGE_SKIP_TLS_VERIFY
Type: boolean
Default: false

Skip TLS certificate verification.

EDGE_ALLOW_INSECURE

ENV: EDGE_ALLOW_INSECURE
Type: boolean
Default: false

Allow insecure connections to the control plane.

GATEWAY_UNIFIED_ROUTER_PATH

ENV: GATEWAY_UNIFIED_ROUTER_PATH
Type: string
Default: /v1

The base path of the Main Ingress on the Edge Gateway. Set it to the same value as UNIFIED_ROUTER_PATH on AI Studio. Available from v2.2.0.

GATEWAY_UNIFIED_ROUTER_DISABLED

ENV: GATEWAY_UNIFIED_ROUTER_DISABLED
Type: boolean
Default: false

Turns off the Main Ingress on the Edge Gateway. Available from v2.2.0.

GATEWAY_SERVER_TIMING

ENV: GATEWAY_SERVER_TIMING
Type: boolean
Default: false

Adds a Server-Timing header to LLM responses. The header splits the latency into gateway time and upstream time. Available from v2.2.0.

METRICS_AUTH_TOKEN

ENV: METRICS_AUTH_TOKEN
Type: string

The bearer token that a scraper must send to read /metrics. If you do not set this variable or METRICS_ALLOW_UNAUTHENTICATED, the Edge Gateway does not serve /metrics. Available from v2.2.0.

METRICS_ALLOW_UNAUTHENTICATED

ENV: METRICS_ALLOW_UNAUTHENTICATED
Type: boolean
Default: false

Serves /metrics without a token, for example for scrapes inside a cluster. Use it only where a firewall or network policy limits access to the endpoint. Available from v2.2.0.

OCI_PLUGINS_MAX_PLUGIN_SIZE

ENV: OCI_PLUGINS_MAX_PLUGIN_SIZE
Type: string
Default: 512MB

The maximum size of one plugin layer that the Edge Gateway downloads from an OCI registry. Available from v2.2.0.

EDGE_TOKEN_CACHE_STALE_GRACE

ENV: EDGE_TOKEN_CACHE_STALE_GRACE
Type: duration
Default: 0

Lets the Edge Gateway use a token validation that just expired while AI Studio is not reachable. 0 refuses the token (fails closed). Available from v2.2.0.

EDGE_TLS_SERVER_NAME

ENV: EDGE_TLS_SERVER_NAME
Type: string

The server name to verify on the AI Studio certificate. Available from v2.2.1.

ANALYTICS_WRITER_QUEUE_SIZE

ENV: ANALYTICS_WRITER_QUEUE_SIZE
Type: integer
Default: 50000

The size of the analytics writer queue. Available from v2.2.0.

ANALYTICS_WRITER_BATCH_SIZE

ENV: ANALYTICS_WRITER_BATCH_SIZE
Type: integer
Default: 500

The number of analytics records in each write batch. Available from v2.2.0.

ANALYTICS_WRITER_FLUSH_INTERVAL

ENV: ANALYTICS_WRITER_FLUSH_INTERVAL
Type: duration
Default: 100ms

How often the analytics writer flushes a batch. Available from v2.2.0.

OVERLOAD_SHEDDING_ENABLED

ENV: OVERLOAD_SHEDDING_ENABLED
Type: boolean
Default: true

Rejects new requests with 503 when memory use is near the limit, instead of running out of memory. Available from v2.2.0.

OVERLOAD_MEMORY_LIMIT

ENV: OVERLOAD_MEMORY_LIMIT
Type: string

The memory limit for load shedding. When not set, the Edge Gateway uses GOMEMLIMIT or the container memory limit. Available from v2.2.0.

OVERLOAD_MEMORY_THRESHOLD

ENV: OVERLOAD_MEMORY_THRESHOLD
Type: float
Default: 0.85

The fraction of the memory limit at which load shedding starts. Available from v2.2.0.

MAX_INFLIGHT_REQUESTS

ENV: MAX_INFLIGHT_REQUESTS
Type: integer
Default: 0

The maximum number of concurrent proxy requests. 0 turns off the limit. Available from v2.2.0.

PROFILING_ADDR

ENV: PROFILING_ADDR
Type: string
Default: 127.0.0.1:6060

The address where the Edge Gateway serves pprof when ENABLE_PROFILING is true. Available from v2.2.0.

GOGC

ENV: GOGC
Type: integer

The Go garbage collector setting. When not set, the Edge Gateway uses an adaptive value that starts at 400. Available from v2.2.0.

GOMEMLIMIT

ENV: GOMEMLIMIT
Type: string

The Go soft memory limit. When not set, the Edge Gateway sets it to 90% of the container memory limit. Available from v2.2.0.