Skip to content

Tyk API Key

Service Name: Tyk API Gateway

Service Description: Tyk is an open-source API Gateway and Management Platform that helps organizations control who accesses their APIs, when they access them, and how they access them. It provides features for API management, security, and analytics.

Service Address: https://tyk.io/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the API policy level within Tyk Gateway

Secret Access Scope: Grants access to APIs managed by the Tyk Gateway according to the policies associated with the key. Can provide access to the Tyk Dashboard API depending on key configuration.

Secret Revokement URL: https://tyk.io/docs/tyk-apis/tyk-dashboard-api/api-keys/#delete-key

Secret Example: 53ac07777cbb8c2d53000002d698728b9a9e11234e9a1a8a3c93ef8ba173

Suspicious Activity Investigation Instructions:

  • Review Tyk Gateway logs for unusual API access patterns or high volumes of requests
  • Check for unexpected API calls from unfamiliar IP addresses or locations
  • Monitor for attempts to access APIs outside the normal policy scope
  • Review analytics data in the Tyk Dashboard for anomalous usage patterns
  • Check for brute force attempts or credential stuffing attacks against your APIs

Mitigation Instructions:

  • Log into your Tyk Dashboard
  • Navigate to the "Keys" section
  • Locate the compromised API key
  • Click "Delete" to immediately revoke access
  • Generate a new API key with appropriate scopes and policies
  • Update any legitimate clients with the new API key
  • Consider implementing more restrictive policies for the new key
  • Enable rate limiting and quotas to prevent abuse
  • Consider implementing mutual TLS for additional security