name: Tyk API Rate Limits
specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Tyk
providerId: tyk
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - API Gateway
  - API Management
  - GraphQL
  - Open Source
  - Rate Limiting
description: Tyk's gateway-side rate limiting is operator-configurable rather than fixed per tier. The
  documentation describes multiple algorithms (Redis-backed sliding window, fixed window, smoothing)
  but does not publish per-second numeric defaults for the SaaS Tyk Cloud surface — limits are tied to
  the operator's policy/key configuration. Throttled requests return HTTP 429.
sources:
  - https://tyk.io/docs/api-management/rate-limit/
  - https://tyk.io/pricing/
responseCodes:
  throttled: 429
limits:
  - name: Operator-Configured Rate Limit
    scope: key
    metric: varies
    limit: see https://tyk.io/docs/api-management/rate-limit/
    notes: Configured per API key, policy, or endpoint by the gateway operator. Default values are not
      published as fixed per-tier numbers; commercial plans (Core, Professional) advertise unlimited
      gateway capacity.
  - name: Spike Arrest (Redis Limiter)
    scope: key
    metric: varies
    limit: see https://tyk.io/docs/api-management/rate-limit/
    notes: Redis-backed limiter blocks requests until the rolling rate drops below the configured threshold.
  - name: Fixed Window Limiter
    scope: key
    metric: varies
    limit: see https://tyk.io/docs/api-management/rate-limit/
    notes: Blocks requests for the remainder of a fixed window once the threshold is exceeded.
policies:
  - name: Algorithm Choice
    description: Operators can select between Redis-backed sliding window, fixed window, and rate-limit
      smoothing. Algorithm and threshold are set on the API definition or policy.
  - name: Smoothing
    description: Rate-limit smoothing gradually adjusts allowance rather than abruptly blocking, giving
      clients time to back off.
  - name: 429 Handling
    description: Clients should detect HTTP 429 and apply exponential backoff with jitter; specific Retry-After
      timing is implementation-dependent.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com