Skip to main content
Licensed Protected Product This page contains all release notes for Dashboard displayed in reverse chronological order

​
Support Lifetime

Only the most recent Tyk Dashboard release and the most recent on the Long Term Support (LTS) branch are supported. We recommend staying current on the feature or LTS branch to minimise exposure to security vulnerabilities from third party dependencies.

​
5.14 Release Notes

​
5.14.0 Release Notes

​
Release Date 7 July 2026

​
Release Highlights

Client IdP Registry for JWT Authentication Tyk Gateway’s JWT authentication middleware validates tokens against JSON Web Key Sets (JWKS) retrieved from a 3rd party Identity Provider (IdP), and maps OAuth scopes to Policies using configuration stored in each API definition. When multiple APIs share the same IdP, this means duplicating the same issuer, JWKS endpoint, and scope-to-policy mapping across every API definition. The new Client IdP registry extracts the IdP details and scope-to-policy mapping from the API definitions into a central registry. When a request is received, Tyk Gateway checks the API definition first (for backward compatibility) before checking the registry. Updating the registry automatically applies to all APIs that reference that IdP, without touching the API definitions themselves. A full CRUD API has been implemented in Tyk Dashboard for creating and managing Client IdP assets. See the changelog for the endpoint reference.
There is no support for management of the Client IdP Registry from the Tyk Dashboard UI at this time.
OAuth 2.0 Configuration in the API Designer The API Designer has been updated to support configuration of the new oauth2 security scheme introduced in Tyk Gateway 5.14.0, which enables authentication against an external Authorization Server such as Keycloak, Okta, or Auth0. The new OAuth 2.0 option appears alongside JWT in the authentication method selector, reflecting that the two are typically configured together. Deprecated methods are listed at the bottom to guide users toward current options. Warnings and contextual help have been added throughout to guide users through scope enforcement and token exchange configuration. Existing APIs using the previous top-level authentication.protectedResourceMetadata configuration are automatically migrated at Tyk Dashboard startup to use the new configuration field located inside the oauth2 scheme. No manual changes to API definitions are required. Granular Enforced Timeout Configuration in the API Designer The API Designer now supports the granular enforced timeout configuration introduced in Tyk Gateway 5.14.0. Both API-level and endpoint-level timeouts can be configured using human-readable values such as 500ms, 1.5s, or 2m, replacing the previous whole-second-only entry for endpoint-level timeouts. For Tyk OAS APIs, the designer automatically rounds the configured value up to the nearest second and stores it in the legacy field, ensuring continued operation with older Tyk Gateway versions. For Tyk Classic APIs, the API-level timeout (global_enforce_timeout) and the granular endpoint-level field (extended_paths.hard_timeouts.duration) must be set directly in the raw API editor; the legacy endpoint-level field must also be set manually for compatibility with older Gateways. Other Changes This release also delivers: support for configuring the new file:// KV storage option in the API editor; a dedicated log level control (log_level) for Tyk Dashboard application logs; logging of failed login attempts by inactive users; and an update to the embedded Tyk Identity Broker to version 1.7.3. Notable fixes include: loss of JWT Advanced Claim Mapping configuration when upgrading from pre-5.10.0 versions; policies becoming invisible to non-admin users after their referenced APIs are deleted; a Tyk Dashboard UI crash when an OAS parameter uses the content keyword; and temporary files accumulating on disk after multipart OpenAPI document imports. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release

​
Dependencies

3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.14.0, please follow the detailed upgrade instructions.

​
Downloads

Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.14.0.

​
Changelog

Added
We have introduced a new asset class managed by Tyk Dashboard - Client IdPs. A full CRUD API has been implemented for the creation and management of these assets in the main storage, alongside API definitions.Each client IdP asset is configured with:
  • a unique user-defined (or automatically-assigned) identifier
  • Organisation ID to enforce per-Org scope
  • human-readable name for display in the UI (when supported)
  • Identity Provider’s unique issuer identifier
  • IdP’s JWKS endpoint
  • a mapping of API definitions to scope-to-policy mappings for APIs using this IdP
These client IdP assets extract the IdP details (issuer value and JWKS endpoint) and the scope-to-policy mapping from the API definitions, and instead hold a central configuration per IdP with a list of APIs to which these should be applied.When a request is received, the Gateway will first check any JWKS URLs and scope-to-policy mappings in the API definition (for backward compatibility) before checking the registry.The new endpoints to manage the registry are:
  • GET /api/clientidps - list all client IdP assets for an Org
  • POST /api/clientidps - create a new entry in the register
  • GET/PUT/DELETE /api/clientidps/{id} - manage an existing entry in the register
  • PATCH /api/clientidps/{id}/mappings - bulk partial update to an asset’s API mapping table
  • GET/PUT/DELETE /api/clientidps/{id}/mappings/{api_id} - manage one API mapping
You can now configure an enforced (request) timeout at API level. This API-level timeout takes precedence over the Gateway default (proxy_default_timeout). The more granular endpoint-level timeout overrides the API-level value.Both API-level and endpoint-level timeouts accept granular configuration using human-readable values such as 500ms, 1.5s, or 2m. Previously, the endpoint-level timeouts could only be configured in seconds.The Tyk OAS API designer exclusively supports the new format for both API-level and endpoint-level settings; behind the scenes the new value configured for an endpoint-level timeout is rounded up to the nearest second and stored in the legacy field to ensure continued operation with older Gateways.The Tyk Classic API designer only supports the legacy field for endpoint-level timeouts. If you want to set an API-level timeout (global_enforce_timeout in the version_data section), or a more granular endpoint-level timeout (extended_paths.hard_timeouts.duration), you must do this in the API editor. Note that Tyk does not automatically set the legacy endpoint-level field for you, so you must set a value in here to ensure continued operation with older Gateways.
The API Designer supports the new OAuth 2.0 authentication method and guides users through configuring it correctly. A new OAuth 2.0 option appears alongside JWT in the authentication method selector, reflecting that the two are typically configured together. Deprecated methods are listed at the bottom to steer users toward current options. Warnings and guidance have been added throughout to help users configure scope enforcement and token exchange correctly.
Existing APIs using the previous top-level authentication.protectedResourceMetadata configuration are automatically migrated to the new location inside the oauth2 scheme at Dashboard startup. No manual changes to API definitions are required.
The new file:// storage option added to Tyk Gateway’s Key-Value secret storage feature can be configured in the API editor.In the API designer, if a TLS certificate is located using a key-value reference, the Dashboard UI will direct the user to the API editor to view or modify the reference.
The Dashboard now has a dedicated application log verbosity setting (log_level) to match those of other Tyk components. It accepts the same values: error, warn, info (the default), and debug. This applies to all Dashboard application logs.The global TYK_LOGLEVEL still takes precedence over TYK_DB_LOGLEVEL when it is set, an invalid value falls back to info with a warning, and the --debug flag continues to force debug verbosity.
The Dashboard now generates an entry in the application log when an authenticated request is rejected because the Dashboard user account is inactive.This log entry, which is generated as a warning, includes the user’s ID and group ID to aid with debugging, without including any personally identifiable information in the log.
Changed
Tyk Dashboard embeds Tyk Identity Broker. This has been updated to version 1.7.3.
Fixed
Docker images published in v5.13.0 contained mixed layer compression: base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: zstd compression is not officially supported for docker images.All image layers are now uniformly compressed using gzip, restoring compatibility with skopeo, oc image mirror, and other tools that do not support OCI zstd compression.
We have resolved an issue where the Advanced Claim Mapping configured for a Tyk OAS API using JWT Auth could be accidentally cleared following an upgrade from a pre-5.10.0 version of the Tyk Dashboard. The API Designer would remove the authentication.securitySchemes.jwtAuth.scopes configuration when the API was updated following the upgrade, leaving the API incorrectly configured.The Dashboard’s API Designer no longer makes this unrequested modification to the API definition.
We have resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user’s policy group permissions (Read or Write grants access, Deny does not).
We have resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received HTTP 401 Unauthorized, while an admin user making the same request correctly received HTTP 400 Bad Request.Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: HTTP 401 Unauthorized is still returned when the resource exists but the user does not own it.
We have resolved an issue where importing a multipart OpenAPI document from a ZIP archive left temporary files on the Dashboard’s local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI content keyword (rather than schema) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
We have resolved an issue where a harmless, but unnecessary upstream.proxy.enabled=false could be added to the Tyk Vendor Extension when using the Tyk Dashboard API Designer. This was due to a serialization artifact in the UI and has been corrected. The resultant API definition no longer contains this unwanted configuration.
Security Fixes

​
5.13 Release Notes

​
5.13.1 Release Notes

​
Release Date 2 July 2026

​
Release Highlights

This patch implements several changes and fixes to improve the stability and correct the behavior of the Dashboard. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release

​
Dependencies

3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.13.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Changed
Tyk Dashboard embeds Tyk Identity Broker. This has been updated to version 1.7.3.
Fixed
Docker images published in v5.13.0 contained mixed layer compression — base image layers used zstd compression while Tyk application layers used gzip. This caused image copy and promotion failures with legacy Docker tooling, older registry versions, and some security scanners, with the error: zstd compression is not officially supported for docker images.All image layers are now uniformly compressed using gzip, restoring compatibility with skopeo, oc image mirror, and other tools that do not support OCI zstd compression.
We have resolved an issue where the Advanced Claim Mapping configured for a Tyk OAS API using JWT Auth could be accidentally cleared following an upgrade from a pre-5.10.0 version of the Tyk Dashboard. The API Designer would remove the authentication.securitySchemes.jwtAuth.scopes configuration when the API was updated following the upgrade, leaving the API incorrectly configured.The Dashboard’s API Designer no longer makes this unrequested modification to the API definition.
Resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user’s policy group permissions (Read or Write grants access, Deny does not).
Resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received HTTP 401 Unauthorized, while an admin user making the same request correctly received HTTP 400 Bad Request.Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: HTTP 401 Unauthorized is still returned when the resource exists but the user does not own it.
Resolved an issue where importing a multipart OpenAPI document from a ZIP archive left temporary files on the Dashboard’s local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI content keyword (rather than schema) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
We have resolved an issue where a harmless, but unnecessary upstream.proxy.enabled=false could be added to the Tyk Vendor Extension when using the Tyk Dashboard API Designer. This was due to a serialization artifact in the UI and has been corrected. The resultant API definition no longer contains this unwanted configuration.
Security Fixes

​
5.13.0 Release Notes

​
Release Date 19 May 2026

​
Release Highlights

MCP Gateway Management Tyk Dashboard 5.13.0 adds comprehensive support for the MCP (Model Context Protocol) Gateway. A dedicated /api/mcps endpoint set provides full CRUD operations for MCP Proxy definitions.
  • A new mcp RBAC permission group (deny/read/write) controls access to MCP management independently of the existing apis permission. Visibility is controlled solely by the mcp RBAC permission.
  • Sessions (Keys) and Policies can now carry four new MCP-specific access-right fields for configuring tool-based access control and per-primitive rate limiting.
This release also delivers a range of Dashboard UI enhancements, bug fixes, and CVE fixes to provide additional protection against security vulnerabilities. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

MCP Proxy policies incorrectly synchronize to Developer Portal versions prior to 1.17.2 Dashboard 5.13.0 introduces policies that grant access to MCP Proxies. Tyk Developer Portal versions prior to 1.17.2 may automatically retrieve these policies and present them as API Products when synchronizing with the Dashboard. There is no facility at this time for Developer Portal to manage API Products that grant access to MCP Proxies. An administrator could inadvertently publish an MCP server to API Consumers leading to a confusing experience. Upgrade to Developer Portal 1.17.2 or later before or immediately after upgrading the Dashboard. Developer Portal 1.17.2 recognises MCP Proxy policies and does not make them available as API Products. Strict Validation of Characters Allowed in Policy IDs To avoid an issue where Policy IDs containing special characters could cause problems when parsing API endpoint requests, we have introduced strict validation of Policy IDs during Policy creation and update. The allowed characters are:
  • alphanumeric characters
  • _
  • -
  • .
  • ~
Strict validation can be disabled, if required for existing Policies with incompatible Policy IDs, using the new Dashboard configuration allow_unsafe_policy_ids. If using this mode, care must be taken not to use characters that could affect URL parsing.

​
Dependencies

To use MCP Gateway features introduced in this release, upgrade the following Tyk components at the same time:
  • Gateway v5.13.0: MCP Proxy request handling, SSE streaming, TBAC, and per-primitive rate limiting
  • Pump v1.15.0: MCP analytics (MongoDB, PostgreSQL, Elasticsearch, and Prometheus backends)
  • MDCB v2.11.0: MCP analytics routing in distributed deployments
  • Operator v1.4.0: MCP Proxy management via Kubernetes CRDs
  • Sync v2.1.7: MCP Proxy support in dump and sync operations
  • Developer Portal v1.17.2 and later: filter all MCP Proxy policies from the developer catalogue; v1.17.1 provides a partial mitigation covering policies with TBAC or per-primitive rate limiting configured
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.13.0, please follow the detailed upgrade instructions. If your deployment uses MCP Gateway, additional component ordering applies:
  • In distributed deployments, MDCB 2.11.0 must be deployed before Gateway and Dashboard.
  • Tyk Operator 1.4.0 must be deployed after Gateway and Dashboard are running.
  • Portal 1.17.3 or later should be deployed before any MCP Proxy policies are created in Dashboard.
See MCP Gateway upgrade considerations for the full sequence.

​
Downloads

Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.13.0.

​
Changelog

Added
We have introduced the /api/mcps endpoint set, providing full CRUD operations for MCP Proxy definitions:
  • GET /api/mcps: list MCP Proxies
  • POST /api/mcps: create an MCP Proxy
  • GET /api/mcps/{id}: retrieve an MCP Proxy
  • PUT /api/mcps/{id}: update an MCP Proxy
  • DELETE /api/mcps/{id}: delete an MCP Proxy
A schema endpoint at /api/schemas/apidefs/mcp returns the MCP Proxy definition JSON schema. MCP Proxy definitions are not returned by the standard API listing endpoints.For details, see the Managing MCP Proxies documentation.
We have introduced a dedicated mcp permission group (deny/read/write) for controlling access to MCP management endpoints in the Dashboard. Previously, /api/mcps endpoints fell under the apis permission.Users who need to manage MCP Proxies must be granted mcp: write. Read-only access to MCP listings requires mcp: read. This change allows organizations to grant access to MCP management without also granting broader API management permissions.For details, see the Managing MCP proxies documentation.
Sessions and Policies now support four new fields for configuring Tool-Based Access Control (TBAC) and per-primitive rate limiting on MCP Proxies:
  • json_rpc_methods: per-method rate limits (e.g., tools/call, resources/read)
  • json_rpc_methods_access_rights: allow or deny rules by JSON-RPC method name
  • mcp_primitives: per-primitive rate limits keyed by type and name
  • mcp_access_rights: allow or deny rules by primitive type and name (tool, resource, or prompt)
Validation rejects these fields on non-MCP APIs with an HTTP 400 Bad Request response. Unknown API IDs are skipped during validation to avoid false negatives at Gateway startup.For details, see the MCP Proxy policies documentation.
We have added a new, simplified, approach to configuring Session lifetime within Redis.Two new fields have been added to the Session object, which can be directly configured when creating Sessions using the Keys API or Policy API, or from the key/policy management screens in the Dashboard UI:
  • post_expiry_action - determines what happens to the data in Redis after the expires timestamp is reached.
  • post_expiry_grace_period - defines how long (in seconds) the Session is kept in Redis after expiration (if the post_expiry_actions is to retain the Session)
The existing Gateway-wide global session lifetime override is still respected.The legacy API level controls can still be used if both new fields are set to 0 (or unset) so there is no change in behavior for existing Sessions.
We have introduced several improvements to the Dashboard UI to enhance security, usability, and developer productivity.
  • Masked sensitive configuration values: Sensitive fields such as HMAC shared secrets, JWT public keys, OAuth client secrets, upstream basic auth passwords, Dashboard API access tokens, and Kafka SASL passwords are now masked by default across the API Designer, Tyk Classic and Tyk OAS API configuration forms, and Universal Data Graph data source configurations. A reveal/hide toggle allows authorised users to view values when needed, and values are automatically re-masked on page refresh.
  • Improved certificate ID visibility: Certificate IDs are now displayed in full when space allows, and truncated from the left (preserving the distinctive fingerprint) when space is limited. The behavior is consistent across the Certificate Store, API Designers, Keys, Policies, and all certificate selection components, with the full ID always available on hover.
  • Configurable toast notification duration: The display duration of toast notifications can now be configured separately for success, warning, info, and error messages via the new ui.notifications.duration configuration option, replacing the previous fixed three-second duration. This helps reduce visual noise from frequent notifications while keeping critical messages visible for longer.
  • Skip Universal Data Graph schema update confirmations: Added a checkbox to suppress the confirmation modal when updating Universal Data Graph schemas. When selected, confirmations are skipped for the remainder of the browser session and reset on a new session, supporting faster iterative development while preserving safe defaults.
Fixed
We have resolved an issue where JavaScript-style Unicode regex patterns in OpenAPI documents failed validation during API import.Previously, when regex patterns containing Unicode escape sequences (for example \u0000-\u017f) were defined with single quotes in YAML, the YAML-to-JSON conversion process would double-escape the backslashes, transforming valid \u sequences into invalid \\u sequences that were rejected by Tyk’s regex validator.The system now automatically translates these escape sequences during API ingestion, ensuring that OpenAPI documents with JavaScript regex patterns import successfully regardless of whether single or double quotes are used in the YAML definition.
We have resolved an issue where the Dashboard’s “Filter by API” feature on the TLS/SSL Certificates page did not return all certificates linked to an API.Previously, the filter only displayed certificates used for client-to-gateway mTLS, ignoring certificates used for gateway-to-upstream mTLS, custom domain certificates, and certificate pinning. This resulted in incomplete and misleading results for users trying to view all certificates actively used by a given API.The Dashboard now correctly returns all certificates when filtering by API.
We have resolved an issue when importing an updated OpenAPI document to update an existing Tyk OAS APIs if the OpenAPI document contained external parameter references.Previously, when importing OpenAPI documents that referenced multiple distinct parameters from external files (e.g., $ref: './parameters.yaml#/ID', $ref: './parameters.yaml#/Name'), the Dashboard’s import process incorrectly collapsed all external references into a single generic parameter component and duplicated that reference multiple times, creating invalid OpenAPI specifications with multiple parameters having the same name and location.The Dashboard now properly resolves external parameter references to distinct parameter definitions during import, ensuring that each $ref becomes a separate, uniquely-named parameter component and maintains OAS compliance for successful updates.
We have resolved an issue where policy IDs containing special characters could cause problems when parsing API endpoint requests. Previously, policy IDs with characters such as #, ?, %, and / would interfere with URL parsing in Dashboard and Gateway API endpoints that use the policy ID as a path parameter, potentially causing request failures or unexpected behavior.We have introduced strict validation across both the Dashboard and Gateway APIs to restrict policy identifiers to a safe character set (alphanumeric characters plus _, -, ., ~). The validation occurs during policy creation and updates via the following endpoints:
  • POST /api/portal/policies and PUT /api/portal/policies/{id} (Dashboard API)
  • POST /tyk/policies and PUT /tyk/policies/{polID} (Gateway API)
The API now returns a clear error message if an unacceptable character is used in the policy ID field, ensuring reliable policy management across all deployment types.
This release fixes a migration issue affecting Tyk OAS APIs with JWT authentication that were created on versions prior to v5.10.0 - the release in which the multiple IdP enhancement introduced the new subjectClaims, basePolicyClaims, and jwksURIs fields, replacing the legacy identityBaseField and policyFieldName in the Dashboard UI. When a Tyk OAS JWT API definition created on an earlier version is now loaded in the Dashboard, the legacy field values are automatically copied into the new fields:The jwksURIs field is also now populated correctly on initial load rather than only after saving. Backward compatibility is preserved: the legacy fields are left untouched in the API definition, so the API will continue to work correctly with older Gateways during a phased upgrade.
We have resolved an issue where an API’s expiry date could drift back by one day each time the API was saved in the API Designer. This was reported by users in positive UTC timezones (such as UTC+8). Saving an API without changing the expiry is now fully idempotent, and the expiry date remains stable across repeated saves regardless of the user’s timezone.
We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an unlimited node license. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of 409 Conflict responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient 409 Conflict responses instead of looping, and the Redis load generated during registration storms is substantially reduced.A dedicated fix for limited node license deployments will be provided in an upcoming release.
Security Fixes
We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:

​
5.12 Release Notes

​
5.12.1 Release Notes

​
Release Date 21st April 2026

​
Release Highlights

Tyk Dashboard has been updated to Golang 1.25 and Debian 13 (Trixie) for enhanced security and performance. This release also addresses multiple CVEs in dependent libraries. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.12.1, please follow the detailed upgrade instructions.

​
Downloads

Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.12.1.

​
Changelog

Changed
The Tyk Dashboard has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
Updated the Docker images to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
Security Fixes
Addressed the following CVEs, providing increased protection against security vulnerabilities:

​
5.12.0 Release Notes

​
Release Date 06 March 2026

​
Release Highlights

OpenAPI Specification 3.1 is now supported In this release, we are delighted to bring initial support for OAS 3.1, covering:
  • Import and validation of OpenAPI 3.1 descriptions using Tyk Dashboard to create Tyk OAS APIs
  • OAS 3.1 features:
    • Full JSON Schema Support and $schema keyword
    • The single example keyword is deprecated in OAS 3.1
    • type can be an array
    • exclusiveMinimum and exclusiveMaximum keywords
We do not yet have support for all new features. For more details, see the documentation. Simplified Management of Versioned Tyk OAS APIs Managing versioned API hierarchies is now much easier and safer. We’ve introduced the ability to promote any child API version to become the new base (routing) API directly from the Dashboard UI, seamlessly transferring routing configurations without service disruption. Additionally, we’ve improved the experience of deleting a base API. Instead of manually cleaning up orphaned child APIs, you are now presented with clear, intelligent options: promote a child to the new base, delete all associated child APIs together, or leave them as independent APIs. These enhancements eliminate manual cleanup work and give administrators full control over their API lifecycles. Enhanced Security with Client Certificate-Token Binding To provide an additional layer of security for your APIs, we’ve introduced Dashboard support for Client Certificate-Token Binding. This feature allows you to form a strict binding association between an Auth Token issued to a client and their specific client certificate. By ensuring that a token can be used only with its bound certificate, you can significantly reduce the risk of token theft or misuse. You can now easily manage these bindings directly from the Dashboard when creating or modifying keys, with full support for certificate rotation scenarios by allowing multiple certificates to be bound to a single key. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.12.0, please follow the detailed upgrade instructions.

​
Downloads

Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.12.0.

​
Changelog

Added
This release introduces initial support for importing and validating OpenAPI 3.1 descriptions to create Tyk OAS APIs. The implementation maintains backward compatibility with OAS 3.0 while adding support for the new JSON Schema 2020-12 validator:
  • Added full JSON Schema support, including the $schema keyword.
  • Added support for defining type as an array (e.g., ["string", "null"]).
  • Updated exclusiveMinimum and exclusiveMaximum to support numeric values instead of booleans, aligning with OAS 3.1 standards.
  • Deprecated the single example keyword in accordance with the OAS 3.1 specification.
Please note the following limitations in this initial release:
  • Conversion from OAS 3.0 to OAS 3.1 is not yet supported.
  • Reusable Path Item Objects and the new mutualTLS security scheme are not currently supported.
  • Tyk Dashboard’s API Editor does not yet validate the schema in real-time; validation is performed only when saving the API.
This release introduces comprehensive UI and API support for restructuring versioned Tyk OAS API hierarchies, eliminating the manual work previously required to manage orphaned APIs:
  • Added the ability to promote a child API to become the new base API directly from the versions table, automatically reassigning the existing base API as a child version.
  • Enhanced the API Designer deletion workflow for base APIs to present three options: promote a child to base, delete all child versions (bulk deletion), or leave child APIs orphaned (previous behavior).
  • Extended the Dashboard API with a new PATCH /api/apis/oas/{current-base-api-id}/{next-base-api-id} endpoint to programmatically convert a child API into the base API.
  • Added an optional purge parameter to the DELETE /api/apis/oas/{apiId} endpoint to enable bulk deletion of all child APIs when a base API is deleted.
The Tyk Dashboard now supports application logging in structured JSON format. To enable this feature, set the environment variable TYK_DB_LOGFORMAT to json.This feature provides consistency with the Gateway’s JSON log format option (introduced in Tyk 5.6.0) and enables better log ingestion by centralized logging systems, SIEM tools, and observability platforms. The configuration is case-insensitive and falls back to the standard text format for any invalid values, ensuring backward compatibility and reliable operation.
The Dashboard API’s policy management endpoints now support the recommended Policy ID (id) for all operations. Previously the API only supported the Policy Database ID (_id) for some operations, which could cause problems when migrating policies between environments. For reasons of backward compatibility, the Policy Database ID is still supported.Users are advised to avoid duplicate Policy IDs to minimise the risk of ambiguous interpretation.This enhancement streamlines policy management for users who prefer meaningful, custom identifiers over auto-generated database IDs, while ensuring existing workflows remain unaffected.
This release introduces Dashboard UI and API support for managing Client Certificate-Token bindings for APIs secured with a static mTLS allow list. This allows administrators to easily configure enhanced token security:
  • Added the ability to bind one or more client certificates to a key (token) when creating or modifying it via the Dashboard.
  • Supports binding multiple client certificates to a single key to facilitate certificate rotation scenarios.
  • Maintains full backward compatibility with existing keys that do not specify certificate bindings.
Please note that bound certificates must also be present in the client certificate allow list within the API definition to ensure successful validation after the mTLS handshake.
Renamed “Dynamic mTLS” to “Certificate Authentication” across the Tyk Classic and Tyk OAS API Designers and Key Management screens. It is now presented as a standalone authentication method rather than a sub-option of Auth Token, making it more intuitive to configure and aligning the UI with the Gateway’s updated configuration structure.
Enhanced the visual timeline in the API Designer’s debug panel to make request tracing easier. The “Inspect” tab now clearly differentiates between Request and Response middleware chains with distinct labels and colors, and visually isolates the Reverse Proxy step so you can easily see exactly where the request was sent upstream.
Fixed
Resolved issues preventing GeoIP location data from displaying correctly when using SQL storage for analytics. Previously, the Log Browser showed “GeoIP not recognized” for country codes, and geographic traffic filtering returned empty results, even though location data was properly captured and stored in the database.The Dashboard can now correctly read and display all geographic information, including country codes, city names, coordinates, and timezone data from SQL storage. Geographic traffic filtering by country code now works as expected, enabling users to analyze traffic patterns by location when using SQL-based analytics storage.
Resolved an issue where the Dashboard’s GET /api/apis/{api_id}/keys endpoint incorrectly returned all keys in the environment instead of only keys associated with the specified API. Users can now accurately retrieve and manage keys for individual APIs, eliminating confusion in multi-API environments. Note that adding this filtering can cause minor delays in responses to this endpoint when there are many APIs and keys.
Resolved multiple Dashboard UI issues affecting mTLS configuration and policy management:
  • Certificate Authentication Configuration: Fixed an issue where the Create Key and Edit Key screens would incorrectly require the user to register a client certificate with the key when granting access to an API secured with static mTLS. Additionally, fixed a separate issue where the option to assign the client certificate was not possible when creating a key for an API which has the authentication method changed to use dynamic mTLS.
  • Policy ID Display Consistency: Updated the Dashboard UI to consistently display the policy id field instead of the MongoDB database _id field across all policy listings, detail views, and selection components. This ensures that policy IDs shown in the UI work reliably with JWT pol claims regardless of how policies were created (Dashboard UI vs. Operator) or Gateway configuration settings. Copy-to-clipboard functionality now copies the correct id field, and policy selection dropdowns use consistent identifiers.
These fixes eliminate confusing certificate linking requirements, ensure consistent dynamic mTLS key creation regardless of when certificate authentication is enabled, provide clearer separation between different mTLS authentication modes, and resolve JWT authentication failures caused by users copying database IDs from the UI instead of the proper policy identifiers.
Resolved an issue where swapping certificates in multi-auth (mTLS + Basic auth) keys prevented the original certificate from being reused. Previously, when updating a key’s certificate, the original certificate remained incorrectly associated with the key internally, causing “key with given certificate already found” errors when attempting to reuse that certificate.Tyk now properly detaches certificates during key updates, allowing certificates to be freely reused across different keys after being removed from their original association.
Fixed inaccurate wording and links on the screen presented on startup when the Dashboard license is missing or has expired.
Security Fixes
Multiple high-severity CVEs have been fixed.

​
5.11 Release Notes

​
5.11.1 Release Notes

​
Release Date 13th February 2026

In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.11.1, please follow the detailed upgrade instructions.

​
Downloads

Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.11.1.

​
Changelog

Security Fixes
We have addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:

​
5.11.0 Release Notes

​
Release Date 18 December 2025

​
Release Highlights

Tyk 5.11 delivers security enhancements, streamlined developer workflows, and deeper operational visibility - empowering teams to scale their API programs with confidence and efficiency. Strengthened API Security & Authentication This release advances our security foundation with enhanced JWT authentication capabilities. Teams can now leverage scope-to-policy mapping without requiring default policies, while new support for nested claims enables more granular policy and subject identification. We’ve also added IP spoofing protection through configurable depth selection in X-Forwarded-For headers, and introduced a new Dashboard API endpoint that allows admins to clear JWKS cache across all connected Gateways. Improved Certificate Management & Visibility Certificate management becomes more proactive with enhanced visibility showing which APIs are impacted by each certificate, plus highlighting certificates approaching expiry to prevent service disruptions before they occur. Enhanced Developer Experience API integration gets simpler with automatically populated OpenAPI descriptions that include all accessible URLs based on deployment targets and version identifiers. This reduces integration errors and accelerates time-to-value for API consumers. Advanced Operational Control Operations teams gain greater flexibility with the ability to temporarily remove targets from upstream load balancers during maintenance windows. Enhanced observability comes through OTel trace propagation to custom gRPC plugins, trace ID inclusion in API traffic logs, and dedicated Gateway latency metrics alongside upstream measurements. Stability & User Experience Improvements This release also includes important fixes for memory exhaustion issues when Redis logging is enabled, improved consistency between Dashboard and Gateway validation for JWT configurations, and streamlined policy management with standardized Policy ID usage across the platform. Multiple UI improvements enhance the user experience including fixes for API filtering, certificate search functionality, Quick Start onboarding flow, and various dashboard display issues - ensuring a smoother workflow for API management and configuration tasks. These enhancements collectively strengthen Tyk’s position as the platform of choice for organizations requiring enterprise-scale API management with robust security, operational excellence, and developer productivity. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

In this release we’ve deprecated the policies.allow_explicit_policy_id configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.

​
Upgrade instructions

If you are upgrading to 5.11.0, please follow the detailed upgrade instructions.

​
Downloads

Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.11.0.

​
Changelog

Added
We’ve improved key expiration flexibility in the Tyk Dashboard by adding support for custom expiration periods using human-readable time formats (e.g., “5h,34m,30s”). Users can now input custom timeframes supporting months, weeks, days, hours, and seconds in addition to the existing predefined options, eliminating the previous restriction and removing the need for API calls or manual key revocation for custom expiration times.
Added three new OPA helper functions (isTykOas, isTykClassic, and isTykStreams) that can be used in OPA rules to distinguish between different API types, ensuring that logic is only applied to the appropriate API types.
Introduced a new Dashboard API endpoint GET /certs/{certificateId}/apis that retrieves all APIs linked to a specific certificate. The endpoint returns API names, IDs, and how they are used by each API (client, upstream, server) with proper pagination support, enabling the frontend to display certificate impact information without expensive client-side filtering across all APIs.
  • Proactive Certificate Expiry Notifications in Tyk Dashboard: Added banner notification to inform the user if the Dashboard has received a certificate expiring soon/expired event from the Gateway. Such certificates are now highlighted on the certificates screen.
  • Improved Automatic Configuration Options for API Creation: Enhanced the user experience when importing OpenAPI descriptions by replacing checkboxes with toggle switches and improving the wording of configuration options. The new interface provides clearer descriptions for Request Validation, Mock Responses, Authentication Detection, and Path Restrictions.
  • Enhanced Certificate Management with Impact Visibility: Introduced a new Certificate Details page that displays user-friendly certificate metadata with a toggle between formatted and raw JSON views. The page now shows certificate status indicators (valid, expiring soon, expired) and lists all APIs using the certificate with clickable navigation to their API Designer pages.
Tyk has always added the base path to the servers section of an API’s OpenAPI description. Until now, this has been constructed from the address of the local Gateway with the unique listen path for the API. This is not always accessible, for example for child API versions configured for internal access.Now Tyk will calculate all the URLs where the API can be accessed, adding these to the servers section of the OpenAPI description. This takes into account the versioning identifier if URL location is in use (e.g. <gateway_url>/<listen_path>/v1) and, where edge_endpoints are defined in the Dashboard config, the data plane Gateways where the API is deployed.We have introduced a new Dashboard API endpoint (GET /api/apis/oas/{apiID}/urls) that returns a list of all of these base paths, presented in a structured format including detailed components (protocol, domain, port, listen-path, versioning identifier).The API Designer uses the data from this endpoint to display all known API URLs and also indicates how to select the specific API version (if applicable) using URL, query parameter or header.
We’ve removed the need to supply a default policy when using scope-to-policy mapping with JWT Authentication. Now, if you enable scope-to-policy mapping by configuring scopes.claimName, you do not need to provide a policy ID in defaultPolicies. If a request does not contain any valid scopes, it will be rejected with HTTP 403 Forbidden (default deny). You can still provide a default policy if you require a different behaviour.
Added JWKS cache invalidation endpoint DELETE /api/cache/jwks/{apiID} to the Dashboard API to flush JWKS cache for specific APIs across all connected Gateways. This extends the existing Gateway-level JWKS cache flush functionality to work through the Dashboard API with proper MDCB propagation to data plane Gateways. Access is restricted to admin users with API ownership validation, ensuring secure cache management across distributed Gateway deployments.
Fixed
Fixed an issue where enabling use_redis_log on a Tyk Gateway could cause the Dashboard to exhaust memory due to unbounded log accumulation from the UI notification endpoint.
Fixed an issue where the Dashboard and Gateway had inconsistent validation for base64-encoded JWKS URIs when using JWT authentication. Previously, the Dashboard would accept a URI in the source (or jwt_source for Tyk Classic) field that was not correctly padded, while the Gateway required correct padding. This could cause an API to be saved successfully in the Dashboard but then fail when processed by the Gateway. The fix has been applied to the Dashboard, which now automatically adds the required padding to the base64-encoded string when the API definition is saved. This resolves the inconsistency and ensures the configuration is valid for the Gateway.
Fixed an issue where certificate filtering (filter=with_pk, filter=without_pk) was only applied in detailed mode, causing inconsistent behavior. Tyk now properly applies filtering in both detailed and non-detailed modes, ensuring consistent results regardless of the mode parameter used.
Fixed an issue where the user was unable to delete the policy if the referenced API didn’t exist, even though the user had access to the policy before API deletion.
Renamed XTykApiGateway schema to TykVendorExtension to eliminate case-only naming conflicts with the existing XTykAPIGateway schema. Updated all corresponding $ref references throughout swagger.yml to prevent code generation ambiguity and ensure compatibility across case-insensitive file systems.
The Tyk Policy object has two identifiers id (Policy ID) and _id (Policy Database ID). All policy definitions will have a value in _id when loaded to the Dashboard, used to identify the object in the persistent storage. Historically, the Policy ID (id) has been optional (via the allow_explicit_policy_id Gateway configuration), and different Tyk components have used one or the other, leading to inconsistency and scenarios where a policy might be rejected due to the configuration of IDs. We have simplified the Tyk Gateway to use the Policy ID exclusively, instead of the Policy Database ID, improving consistency across the platform. This means that the allow_explicit_policy_id Gateway configuration is now redundant and marked deprecated, as the Policy ID field is always used. If a policy definition is loaded onto Tyk Dashboard that does not have a Policy ID set, Tyk will automatically set the id field to the value in _id. There are no changes to the Gateway or Dashboard APIs from this enhancement, ensuring backward compatibility.
  • Incorrect Data Range Display in Total API Traffic Dashboard Chart: Fixed an issue where the Total API Traffic chart on the Nodes & Licenses screen displays data from the wrong time period.
  • TIB User Role Mappings Disappeared on Update: Fixed a bug that caused TIB profiles to vanish on updates made to Provider Configuration advanced settings.
  • Access Tab Selection from Filtered Dropdown: Fixed an issue where users and categories could not be selected from filtered dropdown lists in the Access tab of the Tyk OAS API designer.
  • Unable to Apply Multiple Filters to API List: Resolved filtering issues where applying multiple filters (name + category) would drop previously applied filters instead of combining them. Users can now apply multiple filters that work together as expected, with all active filters preserved during pagination and sorting.
  • Data Graph Wizard Incorrectly Displayed: Fixed an issue where the Data Graph onboarding wizard incorrectly appeared when filters returned zero results - it now only shows when no APIs actually exist in the system, keeping filters visible when results are empty.
  • Incomplete Certificate Search in API Designer: Fixed an issue when selecting a TLS certificate to attach to a Tyk OAS API (for example, a client certificate for client-gateway mTLS). To improve performance when scrolling through the list of existing certificates, the UI uses pagination to load a subset of certificates at a time. The certificate ID search would only match against the currently loaded page of certificates, so a certificate might not appear to exist when it does, but just hasn’t been loaded yet. Now the search functionality has been improved to look through the full list of certificates in the Tyk Certificate Store, rather than relying on the paginated data.
Resolved multiple issues preventing successful API testing in the Quick Start onboarding flow. Users can now test APIs with any response type (JSON, HTML, XML) without encountering HTTP 500 errors or blank response displays. Additionally, fixed URL handling issues that occurred when gateway endpoints were configured without URL schemas, ensuring the “Test your API” step works reliably regardless of configuration format.
Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.

​
5.10 Release Notes

​
5.10.2 Release Notes

​
Release Date 2 December 2025

​
Release Highlights

This patch release fixes an issue in the API Designer where JWKS cache timeout values could not be saved properly. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.10.2, please follow the detailed upgrade instructions.

​
Downloads

Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.2.

​
Changelog

Fixed
Fixed an issue where JWKS cache timeout values when configuring JWT authentication could not be saved in the API Designer. The timeout field would appear to accept values, but would disappear after saving the API configuration. Users can now successfully configure and persist JWKS cache timeout settings as expected

​
5.10.1 Release Notes

​
Release Date 19 November 2025

​
Release Highlights

This patch release upgrades the Go build environment and delivers UI, analytics, and security fixes. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.10.1, please follow the detailed upgrade instructions.

​
Downloads

Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.1.

​
Changelog

Changed
We have updated the Go build environment from Debian 11 (“Bullseye”) to Debian 12 (“Bookworm”) across all pipelines. This change ensures that all builds use the latest Go 1.24 patch version, addressing recent CVEs and improving overall security and stability.
Added
Implemented gzip compression for static assets (JavaScript, CSS, images, etc.) when the browser client requests for gzip with the Accepted-Encoding header. This significantly reduces the file size transferred when loading the Dashboard, reducing bandwidth usage and improving page load times for users.
Fixed
Fixed an issue introduced in 5.10.0 where there was a graphical glitch with the code editor in the API Designer.
  • Fixed non-clickable endpoint rows in the Activity page: Fixed an issue where selecting an endpoint in the “Most Popular Endpoints” list on the “Activity Overview” screen did not direct the user to the “Activity by Endpoint” screen.
  • Fixed incorrect error code descriptions in API activity dashboard: Error codes now display correct descriptions (409 shows “Conflict” instead of “Rate limit or quota exceeded”, and missing descriptions for 502, 504, 499, and 422 have been added).
  • Fixed unicode character display in Activity Logs view: Non-ASCII characters (Cyrillic, Arabic, Hindi, Telugu, Yoruba, etc.) now display correctly instead of showing garbled text when viewing request/response logs.
  • Fixed date range filtering showing extra day in analytics charts: Date range selectors now accurately reflect the selected end date instead of automatically including the following day’s data in charts and legends.
  • Fixed Log Browser querying wrong tables when SQL table sharding is enabled: Dashboard now correctly queries sharded tables (tyk_analytics_YYYYMMDD) instead of the main tyk_analytics table when TYK_DB_STORAGE_LOGS_TABLESHARDING=true is configured, ensuring analytics data displays properly with SQL database sharding.
  • Fixed incorrect date labels and data aggregation in analytics charts: Fixed multiple issues in the analytics aggregation layer when using PostgreSQL backend that caused incorrect chart rendering and service problems. Resolved problems, including hourly charts showing nonsensical dates like “30 Nov 1899”, monthly charts displaying incorrect months, incomplete time-series data due to improper date padding, and API activity being incorrectly split across multiple rows.
Security Fixes

​
5.10.0 Release Notes

​
Release Date 13th October 2025

​
Release Highlights

For a comprehensive list of changes, please refer to the detailed changelog.
Streamlined API Versioning Experience
The Tyk Dashboard now provides a completely redesigned versioning experience for Tyk OAS APIs, making API version management intuitive and efficient through guided workflows and centralized controls. Intuitive version creation
  • Step-by-step wizard: Guided process for creating new API versions with clear configuration options at each step
  • Smart configuration cloning: Choose to inherit settings from existing versions or start fresh
  • Flexible publishing: Control version activation and Gateway deployment during creation
  • Pre-configuration support: Set up versioning parameters before creating any versions, preparing APIs for future versioning needs
Centralized version management
  • Unified “Versions” tab: Single location to view and manage all aspects of API versioning
  • Clear configuration visibility: Version identifier settings, proxy options, and version lists displayed in one organized interface
  • Inline editing: Modify version names and configuration directly without navigating between screens
  • Consistent experience: Same interface and capabilities whether working with base or child APIs
Key benefits
  • Eliminate confusion around version setup and management
  • Reduce time spent navigating between different configuration screens
  • Enable proactive versioning preparation for future API evolution
  • Provide clear visibility into version configuration and relationships
Perfect for teams managing multiple API versions or planning version rollout strategies, this enhancement makes API versioning accessible to users of all experience levels while maintaining the power and flexibility that advanced users require.
Certificate Expiry Monitoring and Notifications
The Tyk Dashboard now provides proactive certificate lifecycle management to help prevent service outages caused by expired mTLS certificates. Proactive monitoring capabilities:
  • Event-driven alerts: Certificate expiry events are now available in the Tyk OAS API Designer for webhook and event handler configuration
  • Dashboard API notifications: New endpoint provides programmatic access to certificate status information
    • Smart monitoring: Automatic detection of certificates approaching expiry or already expired with configurable warning thresholds
    • Duplicate prevention: Intelligent notification system prevents alert flooding while ensuring visibility
Key benefits
  • Prevent unexpected API outages due to expired certificates
  • Enable automated certificate renewal workflows through event handlers
  • Provide clear visibility into certificate health across your API infrastructure
  • Support integration with existing monitoring and alerting systems
Perfect for organizations managing multiple certificates across complex API infrastructures where manual certificate tracking becomes impractical. For more details, please see the dedicated Gateway events section.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.10.0, please follow the detailed upgrade instructions.

​
Downloads

Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.10.0.

​
Changelog

Added
Completely redesigned the versioning experience for Tyk OAS APIs with an intuitive wizard-driven workflow and centralized version management interface.New version creation wizard
  • Guided configuration process: Step-by-step wizard for creating new API versions with clear decision points
  • Configuration cloning options: Choose whether to clone settings from an existing version, with selection from available versions when multiple exist
  • Version identifier setup: Configure version location (header, URL path, query parameter) and key name if not already set
  • Publishing controls: Decide whether to immediately activate the new version and select target Gateways using segment tags
Centralized version management
  • New “Versions” tab: Unified interface displaying version identifier configuration and complete version list for both base and child APIs
  • Pre-configuration support: Set up version identifier location, key name, and proxy options before creating any child versions, preparing non-versioned APIs to become base APIs
  • Clear configuration visibility: Version identifier and proxy settings prominently displayed above the version list
  • Inline editing capabilities: Edit version names directly for any API version, and modify versioning configuration from the base API
  • Streamlined access: Create new versions from any API (base or child) with direct access to the creation wizard
Improved user experience
  • Removed legacy version management screens that were difficult to locate
  • Consistent versioning interface across all Tyk OAS APIs
  • Reduced complexity in version setup and management workflows
This enhancement significantly simplifies API versioning workflows and provides better visibility into version configuration and management.
Added certificate expiry monitoring capabilities to help administrators proactively manage certificate lifecycles and prevent service outages.Event handling integration
  • Certificate expiry events (CertificateExpiringSoon and CertificateExpired) are now available as selectable options in the event handling section, enabling users to assign webhooks or other event handlers directly through the UI
Dashboard notifications system
  • Proactive notification endpoint: New GET /api/org/notifications Dashboard API endpoint provides organization-specific notifications for expiring and expired certificates
  • Smart monitoring: In-memory notification repository automatically checks certificate metadata storage and creates notifications for certificates approaching expiry or already expired
  • Configurable thresholds: Dashboard configuration options for refresh intervals and warning thresholds:
Notification details
  • Severity classification: Notifications marked as “warning” for soon-to-expire certificates or “critical” for expired certificates
  • Rich metadata: Each notification includes certificate ID, expiry date, days remaining, and other relevant details
  • Duplicate prevention: Hash-based system prevents duplicate notifications for the same certificate status
Note: This release provides the foundational API and event integration for certificate monitoring. Enhanced UI functionality for certificate management will be available in a future release.This enhancement provides multiple layers of certificate expiry visibility through Gateway events and API-based notifications, ensuring administrators can maintain certificate health across their API infrastructure.
Updated the Tyk OAS API Designer to support multiple claim sources for JWT authentication, enabling multi-Identity Provider scenarios where different providers use different claim names.UI enhancements
  • Multiple subject claims: Replace the single “Subject identity claim” field with support for multiple claim sources
  • Multiple policy claims: Replace the single “Policy claim” field with support for multiple claim mapping sources
  • Multiple scope claims: Replace the single “Scope claim” field with support for multiple scope claim sources
Current implementation
  • Updated API editor schema to accept the new multi-value claim fields
  • Multi-value claim configuration available through the API Designer interface
  • Advanced JWT validation features (custom claims framework, issuer/audience/subject validation, JWT ID enforcement) must be configured directly in the API definition via the API editor or external API calls
  • Existing single-value configurations remain functional for backward compatibility
This enhancement supports scenarios where different Identity Providers use different claim names (e.g., Keycloak’s scope vs Okta’s scp) within the same API configuration, laying the foundation for comprehensive JWT claim validation workflows.Note: Full API Designer integration for these fields will be available in a future release.
Added initial support for OpenAPI Specification compliant multi-authentication configuration in Tyk OAS APIs, enabling flexible authentication workflows that follow standard OpenAPI security patterns.UI enhancements
  • We have added a new toggle in the Tyk OAS API Designer’s Server > Authentication section to choose between “legacy” and “compliant” authentication processing modes when Multiple Authentication Methods is selected:
    • Legacy mode: Existing configuration interface remains available for legacy mode behavior (AND logic for all authentication methods)
    • Compliant mode: Users selecting compliant mode are directed to configure authentication directly in the API editor for full OpenAPI security specification support
Current implementation
  • Manual configuration of compliant mode security settings available through the API definition editor
  • OpenAPI import with automatic authentication configuration continues to configure legacy mode by default (no change to existing behavior)
  • Advanced authentication combinations (OR logic between security entries) must be configured directly in the API definition
This enhancement provides the foundation for OpenAPI compliant authentication workflows while maintaining complete backward compatibility with existing authentication configurations.Note: Full integration for compliant mode authentication configuration will be available in a future release.
Changed
Fixed
Fixed UI issues in policy and key management that caused confusion and unnecessary validation errors. The API Versions field in the Dashboard UI now appears only when relevant - specifically for versioned Tyk Classic APIs.The field is no longer displayed for Tyk OAS APIs or non-versioned Tyk Classic APIs, eliminating confusion about when version selection is required and preventing policies and keys from failing to save due to irrelevant validation requirements.
Fixed some issues in the Tyk OAS API Debugger (Test Your API panel) when inspecting API tests:
  • The debugger only displayed request middleware execution, omitting response middleware from the debug output
  • The debugger did not show the details of the transformations applied by Request Body Transform and Request Header Transform middleware
  • The debugger incorrectly reported errors for endpoints using Response Body Transform middleware, even when API calls completed successfully
The test debugger now correctly shows both request and response middleware execution, accurately displays the execution status, and eliminates false error messages that could mislead developers during API testing and troubleshooting.
Fixed an issue where the Tyk Dashboard did not correctly apply a default page_size value when none was specified in the Dashboard configuration, potentially causing unexpected pagination behavior.The Dashboard now properly defaults to a page size of 10 items as documented, ensuring consistent and predictable pagination across all Dashboard views.
Fixed several issues that affected the creation of new child versions of Tyk OAS APIs to ensure reliable version creation and proper validation:UI and API Creation:
  • Resolved an issue that prevented users from creating new versions via the API Designer’s Manage Versions screen
  • Added validation for the base_api_id parameter - providing a non-existent ID would previously create the API successfully, but leave it invisible in the Dashboard UI
  • Added stricter validation for version names - users can no longer create API versions without specifying a valid new_version_name, preventing unusable or empty version entries
  • Improved error messaging when the base_api_version_name parameter is missing or incorrectly specified
Version Management:
  • Fixed an issue where creating new child versions would incorrectly reset the default version back to the base API, overriding previously configured settings
The system now provides comprehensive validation with clear error responses (HTTP 400 Bad Request and HTTP 422 Unprocessable Entity), ensures that all API versions have meaningful identifiers, and maintains proper default version settings during the creation of child versions.
Fixed an issue where the /api/apis/oas/{apiId}/versions endpoint incorrectly returned version data for Tyk Classic APIs and non-versioned Tyk OAS APIs. The endpoint now properly validates requests and returns HTTP 422 Unprocessable Entity when the target API is not a valid Tyk OAS base API, ensuring the endpoint only returns meaningful version information.
Fixed an issue where custom domains containing regular expressions were not correctly parsed and stored in the servers section of OpenAPI descriptions for Tyk OAS APIs. The Dashboard now properly converts regex-based domains into valid OpenAPI servers entries with appropriate variables, ensuring accurate API documentation and preventing validation errors during API editing.This fix includes enhanced syntax validation for regular expression (regex) patterns and improved capture group handling, which previously could cause Gateway crashes.
Fixed an issue where updates to global webhooks were not immediately applied to Tyk OAS APIs using those webhooks. When global webhook configurations were modified, the Gateway would continue using the previous settings for affected Tyk OAS APIs until a manual reload occurred.The system now automatically triggers a Gateway reload for all impacted Tyk OAS APIs when global webhook configurations are updated, ensuring that the new webhook settings take effect immediately.
Fixed an issue where keys and policies created or updated via the Dashboard API were sometimes rejected by the Dashboard UI, and vice versa, due to inconsistent handling of the versions field for non-versioned Tyk Classic APIs. The issue occurred because the API and UI used different formats when populating the versions list in access rights.Both interfaces now consistently accept either null or [] (empty array) values in the versions field of the access control list, ensuring seamless interoperability between API and UI workflows for policy and key management. Tyk OAS APIs use a different approach to versioning, with each (base or child) version having a unique API ID that is added to the access list.
Fixed an issue where orphaned child versions of a Tyk OAS API would disappear from the Dashboard UI after their base API was deleted, specifically when using PostgreSQL as the datastore.Orphaned Tyk OAS API versions now remain visible in the Dashboard, ensuring consistent behavior across all supported datastores and preventing loss of access to existing API versions.
Fixed an issue where the child versions of a Tyk OAS API were sorted by creation date in the Created APIs and alphabetically by version name (e.g., v1, v2) in the Versions list.Now versions are always sorted alphabetically by version name, providing predictable and controllable ordering.
Fixed an issue where the Tyk Dashboard API would panic and return HTTP 500 Internal Server Error when accessing the /api/logs endpoint without the required start and end timestamp parameters in PostgreSQL environments using table sharding.The API now properly handles missing parameters by returning HTTP 400 Bad Request with a descriptive error message, improving error handling and API reliability.
Fixed an inconsistency where the Dashboard API’s PATCH /api/apis/oas/{apiId} endpoint incorrectly accepted full Tyk OAS API definitions containing Tyk Vendor Extensions, when it should only accept standard OpenAPI descriptions.The endpoint now properly validates incoming requests and returns HTTP 400 Bad Request if the Tyk Vendor Extension is present, ensuring consistent behavior with the Dashboard UI and maintaining the intended separation between OpenAPI description updates and full API configuration changes.
Fixed an issue where duplicate or blank API categories could be created for Tyk OAS APIs when using the Dashboard API’s PUT /api/apis/oas/{API_ID}/categories endpoint. Now, if blank or duplicate category labels are provided in the body of the PUT request, these will be ignored.This matches the validation in the API Designer which does not allow blank or duplicated categories to be assigned to APIs.
Fixed an issue where creating GraphQL APIs using upstream introspection in the Dashboard could fail with HTTP 502 Bad Gateway errors when OPA rules (typically using patch_request) modified the introspection request body.The problem occurred because the Dashboard did not recalculate the Content-Length header after OPA modifications, causing length mismatches that resulted in proxy errors. The Dashboard now properly recalculates the content length for modified introspection requests, ensuring reliable GraphQL API creation regardless of OPA rule configurations.
Security Fixes

​
5.9 Release Notes

​
5.9.2 Release Notes

​
Release Date 5th September 2025

​
Release Highlights

This release fixes a compatibility issue between MDCB and Dashboard where APIs containing dots (.) in their paths were not handled correctly in MDCB. API definitions are now processed consistently with the Dashboard, ensuring middleware works as expected across all gateways. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

To resolve the compatibility issue between MDCB and Tyk Dashboard when Tyk OAS API definition paths contain dot (.) characters, you can choose one of the following upgrade paths:
Recommended Upgrade Paths
  1. Upgrade Dashboard (Preferred)
    • Upgrade to Dashboard v5.9.2 to resolve the issue.
    • In this version, escape_dots_in_oas_paths defaults to false, and the Dashboard automatically unescapes dots in all API definitions.
    • No MDCB upgrade is required.
  2. Upgrade MDCB to v2.8.4 (Alternative if you cannot upgrade the Dashboard)
    • Enable escape_dots_in_oas_paths in both Dashboard and MDCB configurations.
    • This ensures consistent escaping/decoding of dots across all components.
If you are upgrading to 5.9.2, please follow the detailed upgrade instructions.

​
Downloads

  • Docker Image to pull
  • Helm charts
    • tyk-charts v4.0.0 Please note that the Tyk Helm Charts are configured to install the LTS version of Tyk Dashboard. You will need to modify them to install v5.9.2.

​
Changelog

Fixed

​
5.9.1 Release Notes

​
Release Date 14th August 2025

​
Release Highlights

For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

Since 5.9.0, Tyk Dashboard automatically escapes dots (.) in OpenAPI endpoint paths (e.g., /v1.0 becomes /v1\u002e0) before saving to the database. This was introduced to support DocumentDB users as explained in the change log. MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.9.1 and will be fixed in version Dashboard version 5.9.2 and MDCB version 2.8.4.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.9.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed

​
5.9.0 Release Notes

​
Release Date 4th August 2025

​
Release Highlights

This release builds on the recent release of Tyk 5.8.3, adding a collection of new capabilities. For a comprehensive list of changes, please refer to the detailed changelog.
Accept JSON Web Tokens (JWTs) Issued By Multiple Identity Providers
Tyk can now validate JWTs against multiple JSON Web Key Set (JWKS) endpoints, allowing you to use different IdPs to issue JWTs for the same API. Previously, we supported only a single JWKS endpoint in the source field, but now you can register multiple JWKS endpoints in the Tyk OAS API definition. When a request is received bearing a JWT, Tyk will retrieve JWKS from all registered IdPs to check the token’s validity. For full details of how to use this powerful feature see the improved JWT Authentication section. Please note that this functionality is not available for Tyk Classic APIs.
Compatibility with Valkey
Tyk is now fully compatible with Valkey, the open-source (BSD) high-performance key/value datastore backed by the Linux Foundation, as an alternative to Redis.

​
Breaking Changes

  1. We have implemented a change to the behaviour of the GET /api/streams/{apiID} endpoint, which now expects an Accept header, not Content-Type.
  2. Tyk Dashboard now automatically escapes dots (.) in OpenAPI endpoint paths (e.g., /v1.0 becomes /v1\u002e0) before saving to the database. This was introduced to support DocumentDB users as explained in the change log. MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.9.0 and will be fixed in Dashboard version 5.9.2 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.

​
Dependencies

3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.9.0, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Added support for configuration of multiple JWKS (JSON Web Key Set) endpoints for Tyk OAS APIs. This enables the Gateway to authenticate JSON Web Tokens (JWTs) in multi-identity provider environments. The JWKS endpoints are configured in the new jwksURIs array in the JWT Auth securityScheme. This will take precedence over the existing source field, and existing API definitions will be automatically migrated to use the new field, while maintaining backward compatibility in case of rollback. Full support has been added to the Tyk OAS API Designer.
Added compatibility with Valkey database as an alternative to Redis. This is for fresh environments, with no migration support from Redis.
We have introduced a new Dashboard configuration option, TYK_DB_STREAMING_ENABLEALLEXPERIMENTAL, to enable all experimental input and output options for Tyk Streams APIs. This is strictly provided for demos and MVPs and should not be enabled in production use.
Changed
Upgraded to use the latest upstream version of kin-openapi (v0.132.0). This ensures improved compatibility, full stack interoperability, and continued support for existing OpenAPI 3.0.x specifications.
Fixed
Fixed an issue where the /apis/streams/{apiID} endpoint was expecting a Content-Type header instead of an Accept header for GET requests.

​
5.8 Release Notes

​
5.8.15 Release Notes

​
Release Date 30 June 2026

​
Release Highlights

This patch implements several changes and fixes to improve the stability and correct the behavior of the Dashboard. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.15, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Changed
Tyk Dashboard embeds Tyk Identity Broker. This has been updated to version 1.7.3.
Fixed
Resolved an issue where a policy became invisible to non-admin users once all of the APIs it granted access to had been deleted, even though the policy still existed. Users with explicit Read or Write policy permissions lost the ability to see or manage these policies, while admin users were unaffected.Non-admin users can now see and manage such policies again; when ownership cannot be determined from the referenced APIs, visibility falls back to the user’s policy group permissions (Read or Write grants access, Deny does not).
Resolved an issue where, with API ownership enabled, a non-admin user providing an unrecognized API Id in a request to the Dashboard API received HTTP 401 Unauthorized, while an admin user making the same request correctly received HTTP 400 Bad Request.Non-admin users now receive the same error code as admin users when the provided API Id does not exist. Ownership protection is unchanged: HTTP 401 Unauthorized is still returned when the resource exists but the user does not own it.
Resolved an issue where importing a multipart OpenAPI document from a ZIP archive left temporary files on the Dashboard’s local disk after the import completed. Over time this could exhaust disk space and, because the temporary location was derived from the archive filename, a later import using the same filename could reuse stale contents resulting in unexpected API configuration.Imports now use a unique temporary location per upload that is always cleaned up, even if the import fails, and concurrent uploads no longer interfere with one another. This applies to both creation and updating of Tyk OAS APIs, whether imported through the UI or the Dashboard API.
We have resolved an issue where child API versions that were orphaned (due to deletion of the base API version) on Dashboard versions prior to 5.8.6 did not appear in the main API list when using PostgreSQL, and could only be found through search.The Dashboard now detects these legacy orphaned Tyk OAS APIs and restores them to the main API list.
We have resolved an issue where opening a Tyk OAS API whose parameters use the OpenAPI content keyword (rather than schema) caused the API Designer and API Debugger to crash, and the Validate Request middleware form to reject the definition as invalid. The Dashboard now fully supports content-form parameters as defined by OpenAPI Specification 3.0: these APIs load without errors, and saving them preserves the content wrapper, including the media type and inner schema, without writing a conflicting top-level schema.
Fixed an issue where the /apis/streams/{apiID} endpoint was expecting a Content-Type header instead of an Accept header for GET requests.
Security Fixes

​
5.8.14 Release Notes

​
Release Date 21 May 2026

​
Release Highlights

This patch release contains various bug fixes and addresses some vulnerabilities in 3rd party libraries, providing improved performance and security enhancements. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.14, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed
We have resolved an issue where JavaScript-style Unicode regex patterns in OpenAPI documents failed validation during API import.Previously, when regex patterns containing Unicode escape sequences (for example \u0000-\u017f) were defined with single quotes in YAML, the YAML-to-JSON conversion process would double-escape the backslashes, transforming valid \u sequences into invalid \\u sequences that were rejected by Tyk’s regex validator.The system now automatically translates these escape sequences during API ingestion, ensuring that OpenAPI documents with JavaScript regex patterns import successfully regardless of whether single or double quotes are used in the YAML definition.
We have resolved an issue where the “Filter by API” feature on the TLS/SSL Certificates page did not return all certificates linked to an API.Previously, the filter only displayed certificates used for client-to-gateway mTLS, ignoring certificates used for gateway-to-upstream mTLS, custom domain certificates, and certificate pinning. This resulted in incomplete and misleading results for users trying to view all certificates actively used by a given API.The Dashboard now correctly returns all certificates when filtering by API.
We have resolved an issue where an API’s expiry date could drift back by one day each time the API was saved in the API Designer. This was reported by users in positive UTC timezones (such as UTC+8). Saving an API without changing the expiry is now fully idempotent, and the expiry date remains stable across repeated saves regardless of the user’s timezone.
We have resolved a set of related issues affecting Gateway registration with the Dashboard at scale for deployments using an unlimited node license. During mass registrations or rolling upgrades, a combination of lock contention, excessive Redis load, and incorrect handling of 409 Conflict responses could leave Gateways stuck in registration loops without the credentials needed to serve traffic.Gateway registration is now significantly more robust at scale: registration requests are no longer serialized across the fleet, Gateways recover cleanly from transient 409 Conflict responses instead of looping, and the Redis load generated during registration storms is substantially reduced.A dedicated fix for limited node license deployments will be provided in an upcoming release.
Security Fixes
Addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:

​
5.8.13 Release Notes

​
Release Date 22 April 2026

​
Release Highlights

Tyk Dashboard has been updated to Go 1.25 and Debian 13 (Trixie) for enhanced security and performance, including updated FIPS-compliant images. This release also addresses multiple CVEs in dependent libraries. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

No deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.13, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Changed
The Tyk Dashboard has been updated to Golang 1.25, improving security by staying up-to-date with Go versions.
Updated the Docker images for Tyk Dashboard to Debian 13 (Trixie) to address multiple vulnerabilities in the underlying operating system.
Security Fixes
Addressed the following CVEs, providing increased protection against security vulnerabilities, including, but not limited to:

​
5.8.12 Release Notes

​
Release Date 11 March 2026

​
Release Highlights

In this patch, we have fixed a number of small issues related to the management of API Keys (Auth Tokens) for APIs secured with mTLS in the Dashboard UI. We have also fixed the filtering applied when requesting the details of all keys that grant access to a specific API. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

A change has been made to improve security of the legacy Auth Token + Dynamic mTLS method for securing access to APIs deployed on Tyk. This removes the option to authenticate using only the auth token and enforces the mTLS handshake. Previously, API clients could authenticate without presenting the client certificate or holding the client’s private key. For any user relying on that behavior, we have added a new Gateway configuration option: allow_unsafe_dynamic_mtls_token. Unless deliberately configured in the config file or environment, this is set to false to ensure that Tyk is secure by default.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

No deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.12, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed
Resolved issues preventing GeoIP location data from displaying correctly when using SQL storage for analytics. Previously, the Log Browser showed “GeoIP not recognized” for country codes, and geographic traffic filtering returned empty results, even though location data was properly captured and stored in the database.The Dashboard can now correctly read and display all geographic information, including country codes, city names, coordinates, and timezone data from SQL storage. Geographic traffic filtering by country code now works as expected, enabling users to analyze traffic patterns by location when using SQL-based analytics storage.
We have addressed the following issues
  • Create Key and Edit Key screens would incorrectly require the user to register a client certificate with the key when granting access to an API secured with static mTLS.
  • The option to assign the client certificate was not possible when creating a key for an API that has the authentication method changed to use dynamic mTLS.
Fixed inaccurate wording and links on the screen presented on startup when the Dashboard license is missing or has expired.
Resolved an issue where the Dashboard’s GET /api/apis/{api_id}/keys endpoint incorrectly returned all keys in the environment instead of only keys associated with the specified API. Users can now accurately retrieve and manage keys for individual APIs, eliminating confusion when working with multi-API environments. Note that the addition of this filtering can lead to minor delays in the response to this endpoint when there are large numbers of APIs and keys.
Resolved an issue where swapping certificates in multi-auth (mTLS + Basic auth) keys prevented the original certificate from being reused. Previously, when updating a key’s certificate, the original certificate remained incorrectly associated with the key internally, causing “key with given certificate already found” errors when attempting to reuse that certificate.Tyk now properly detaches certificates during key updates, allowing certificates to be freely reused across different keys after being removed from their original association.
Security Fixes
Multiple high-severity CVEs have been fixed.

​
5.8.11 Release Notes

​
Release Date 12 February 2025

​
Release Highlights

In this release, we have fixed some priority CVEs. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

No deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.11, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Security Fixes
Addressed CVEs reported in dependent libraries, providing increased protection against security vulnerabilities, including, but not limited to:

​
5.8.10 Release Notes

​
Release Date 23 December 2025

​
Release Highlights

This patch release addresses a CVE present in 5.8.9. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

In this release we’ve deprecated the allow_explicit_policy_id configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.

​
Upgrade instructions

If you are upgrading to 5.8.10, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Security Fixes
Fixed the following high-priority CVE, providing increased protection against security vulnerabilities:

​
5.8.9 Release Notes

​
Release Date 12 December 2025

​
Release Highlights

This patch release contains various bug fixes and introduces new OPA helper functions to identify the type of API being processed (Tyk OAS, Tyk Streams, Tyk Classic). For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

In this release we’ve deprecated the allow_explicit_policy_id configuration option. This was previously added to allow the use of custom policy IDs, which is now the default behaviour so this option is redundant.

​
Upgrade instructions

If you are upgrading to 5.8.9, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Added three new OPA helper functions (isTykOas, isTykClassic, and isTykStreams) that can be used in OPA rules to distinguish between different API types, ensuring that only appropriate logic is applied.
Fixed
Fixed an issue where enabling use_redis_log on a Tyk Gateway could cause the Dashboard to exhaust memory due to unbounded log accumulation from the UI notification endpoint.
Fixed an issue where the Gateway applied stricter validation than the Dashboard on the base64 encoded JWKS URI provided in the source (Tyk Classic: jwt_source) field when using JWT Auth. The Dashboard would accept a base64 encoded string that was not correctly padded, whereas the Gateway would require this padding.The impact of this was that a JWKS URI could be successfully registered in an API definition via the Dashboard but then would be rejected when the Gateway handled requests to the API. Now the Gateway allows for lack of padding in the string, removing the inconsistency.
Fixed an issue where the user was unable to delete a policy if the referenced API didn’t exist, even though the user had access to the policy before API deletion.
Fixed an issue where certificate filtering (filter=with_pk, filter=without_pk) was only applied in detailed mode, causing inconsistent behavior. Tyk now properly applies filtering in both detailed and non-detailed modes, ensuring consistent results regardless of the mode parameter used.
Fixed redundant boolean enum definitions in OpenAPI specification by removing unnecessary enum: [true, false] declarations from boolean type fields in swagger.yml files. Boolean parameters now use only type: boolean, following OpenAPI best practices.
Renamed XTykApiGateway schema to TykVendorExtension to eliminate case-only naming conflicts with existing XTykAPIGateway schema. Updated all corresponding $ref references throughout swagger.yml to prevent code generation ambiguity and ensure compatibility across case-insensitive file systems.
The Tyk Policy object has two identifiers: id (Policy ID) and _id (Policy Database ID). All policy definitions will have a value in _id when loaded to the Dashboard, used to identify the object in the persistent storage. Historically, the Policy ID (id) has been optional (via the allow_explicit_policy_id Gateway configuration), and different Tyk components have used one or the other, leading to inconsistency and scenarios where a policy might be rejected due to the configuration of IDs.We have simplified the Tyk Gateway to use the Policy ID exclusively, instead of the Policy Database ID, improving consistency across the platform. This means that the allow_explicit_policy_id Gateway configuration is now redundant and marked deprecated, as the Policy ID field is always used.If a policy definition is loaded onto the Tyk Dashboard that does not have a Policy ID set, Tyk will automatically set the id field to the value in _id. There are no changes to the Gateway or Dashboard APIs from this enhancement, ensuring backward compatibility.
Resolved multiple issues preventing successful API testing in the Quick Start onboarding flow. Users can now test APIs with any response type (JSON, HTML, XML) without encountering HTTP 500 errors or blank response displays.Additionally, fixed URL handling issues that occurred when gateway endpoints were configured without URL schemas, ensuring the “Test your API” step works reliably regardless of configuration format.
  • Incorrect Data Range Display in Total API Traffic Dashboard Chart: Fixed an issue where the Total API Traffic chart on the Nodes & Licenses screen displays data from the wrong time period.
  • TIB User Role Mappings Disappeared on Update: Fixed a bug that caused TIB profiles to vanish on updates made to Provider Configuration advanced settings.
  • Access Tab Selection from Filtered Dropdown: Fixed an issue where users and categories could not be selected from filtered dropdown lists in the Access tab of the Tyk OAS API designer.
  • Unable to Apply Multiple Filters to API List: Resolved filtering issues where applying multiple filters (name + category) would drop previously applied filters instead of combining them. Users can now apply multiple filters that work together as expected, with all active filters preserved during pagination and sorting.
  • Data Graph Wizard Incorrectly Displayed: Fixed an issue where the Data Graph onboarding wizard incorrectly appeared when filters returned zero results - it now only shows when no APIs actually exist in the system, keeping filters visible when results are empty.
  • Incomplete Certificate Search in API Designer: Fixed an issue when selecting a TLS certificate to attach to a Tyk OAS API (for example, a client certificate for client-gateway mTLS). To improve performance when scrolling through the list of existing certificates, the UI uses pagination to load a subset of certificates at a time. The certificate ID search would only match against the currently loaded page of certificates, so a certificate might not appear to exist when it does, but just hasn’t been loaded yet. Now the search functionality has been improved to look through the full list of certificates in the Tyk Certificate Store, rather than relying on the paginated data.

​
5.8.8 Release Notes

​
Release 20th November 2025

​
Release Highlights

This patch release upgrades the Go build environment and fixes some high-priority CVEs. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.8, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Changed
We have updated the Go build environment from Debian 11 (“Bullseye”) to Debian 12 (“Bookworm”) across all pipelines. This change ensures that all builds use the latest Go 1.24 patch version, addressing recent CVEs and improving overall security and stability.
Security Fixes
Fixed the following high-priority CVEs, providing increased protection against security vulnerabilities:

​
5.8.7 Release Notes

​
Release 29 October 2025

​
Release Highlights

This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.7, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Fixed
Fixed an issue where child versions of Tyk OAS APIs were sorted inconsistently between different Dashboard screens:
  • chronologically by creation date on the APIs listing page
  • alphabetically by version name on the Manage Versions page
All API version listings now consistently use alphabetical sorting by version name, providing a more predictable and user-friendly experience when navigating between different screens.
Fixed an issue where the API debugger did not display sufficient information about transformations applied by Request Body Transform and Request Header Transform middleware. The debugger now shows detailed logs matching the format used for Response Transform middleware, including specific details about injected headers (e.g., “Adding: key: value”) and body transformations, providing better visibility into request processing for debugging purposes.
Fixed an issue where creating GraphQL APIs using upstream introspection in the Dashboard could fail with HTTP 502 Bad Gateway errors when OPA rules (typically using patch_request) modified the introspection request body.The problem occurred because the Dashboard did not recalculate the Content-Length header after OPA modifications, causing length mismatches that resulted in proxy errors. The Dashboard now properly recalculates the content length for modified introspection requests, ensuring reliable GraphQL API creation regardless of OPA rule configurations.
Resolved an issue where the Dashboard API allowed creation of empty or duplicate categories when updating Tyk OAS APIs through the PUT /api/apis/oas/{API_ID}/categories endpoint. The API now properly validates category labels, automatically filtering out blank entries and duplicates to ensure data consistency. This update aligns the Dashboard API behavior with the existing validation rules in the API Designer interface.
  • Fixed non-clickable endpoint rows in the Activity page: Fixed an issue where selecting an endpoint in the “Most Popular Endpoints” list on the “Activity Overview” screen did not direct the user to the “Activity by Endpoint” screen.
  • Fixed incorrect error code descriptions in API activity dashboard: Error codes now display correct descriptions (409 shows “Conflict” instead of “Rate limit or quota exceeded”, and missing descriptions for 502, 504, 499, and 422 have been added).
  • Fixed unicode character display in Activity Logs view: Non-ASCII characters (Cyrillic, Arabic, Hindi, Telugu, Yoruba, etc.) now display correctly instead of showing garbled text when viewing request/response logs.
  • Fixed date range filtering showing extra day in analytics charts: Date range selectors now accurately reflect the selected end date instead of automatically including the following day’s data in charts and legends.
  • Fixed incorrect data tables being queried when SQL table sharding is enabled: Dashboard now correctly queries sharded tables (tyk_analytics_YYYYMMDD) instead of the main tyk_analytics table when TYK_DB_STORAGE_LOGS_TABLESHARDING=true is configured, ensuring analytics data displays properly with SQL database sharding.
  • Fixed incorrect date labels and data aggregation in analytics charts: Fixed multiple issues in the analytics aggregation layer when using PostgreSQL backend that caused incorrect chart rendering and service problems. Resolved problems, including hourly charts showing nonsensical dates like “30 Nov 1899”, monthly charts displaying incorrect months, incomplete time-series data due to improper date padding, and API activity being incorrectly split across multiple rows.

​
5.8.6 Release Notes

​
Release Date 25th September 2025

​
Release Highlights

This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.6, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Changed
Fixed
Fixed an issue where the Tyk OAS API Debugger (Test Your API panel) only displayed request middleware execution, omitting response middleware from the debug output. The test debugger now correctly shows both request and response middleware execution, providing complete visibility into the entire request-response cycle for better API testing and troubleshooting.
Fixed an issue where custom domains containing regular expressions were not correctly parsed and stored in the servers section of OpenAPI descriptions for Tyk OAS APIs. The Dashboard now properly converts regex-based domains into valid OpenAPI servers entries with appropriate variables, ensuring accurate API documentation and preventing validation errors during API editing. This fix includes enhanced syntax validation for regular expression (regex) patterns and improved capture group handling, which previously could cause Gateway crashes.
Fixed an issue where the Tyk OAS API Debugger (Test Your API panel) incorrectly reported errors for endpoints using Response Body Transform middleware, even when API calls completed successfully. The debugger now accurately displays the execution status and eliminates false error messages that could mislead developers during API testing and troubleshooting.
Fixed an inconsistency where the Dashboard API’s PATCH /api/apis/oas/{apiId} endpoint incorrectly accepted full Tyk OAS API definitions containing Tyk Vendor Extensions, when it should only accept standard OpenAPI descriptions. The endpoint now properly validates incoming requests and returns HTTP 400 Bad Request if the Tyk Vendor Extension is present, ensuring consistent behavior with the Dashboard UI and maintaining the intended separation between OpenAPI description updates and full API configuration changes.
Fixed an issue where the Tyk Dashboard API would panic and return HTTP 500 Internal Server Error when accessing the /api/logs endpoint without the required start and end timestamp parameters in PostgreSQL environments using table sharding. The API now properly handles missing parameters by returning HTTP 400 Bad Request with a descriptive error message, improving error handling and API reliability.
Fixed an issue where orphaned child versions of a Tyk OAS API would disappear from the Dashboard UI after their base API was deleted, specifically when using PostgreSQL as the datastore. Orphaned Tyk OAS API versions now remain visible in the Dashboard, ensuring consistent behavior across all supported datastores and preventing loss of access to existing API versions.
Fixed an issue where keys and policies created or updated via the Dashboard API were sometimes rejected by the Dashboard UI, and vice versa, due to inconsistent handling of the versions field for non-versioned Tyk Classic APIs. The issue occurred because the API and UI used different formats when populating the versions list in access rights. Both interfaces now consistently accept either null or [] (empty array) values in the versions field of the access control list, ensuring seamless interoperability between API and UI workflows for policy and key management. Tyk OAS APIs use a different approach to versioning, with each (base or child) version having a unique API ID that is added to the access list.
Fixed UI issues in policy and key management that caused confusion and unnecessary validation errors. The API Versions field in the Dashboard UI now appears only when relevant - specifically for versioned Tyk Classic APIs. The field is no longer displayed for Tyk OAS APIs or non-versioned Tyk Classic APIs, eliminating confusion about when version selection is required and preventing policies and keys from failing to save due to irrelevant validation requirements.
Fixed an issue where the /api/apis/oas/{apiId}/versions endpoint incorrectly returned version data for Tyk Classic APIs and non-versioned Tyk OAS APIs. The endpoint now properly validates requests and returns HTTP 422 Unprocessable Entity when the target API is not a valid Tyk OAS base API, ensuring the endpoint only returns meaningful version information.
Fixed several issues that affected the creation of new child versions of Tyk OAS APIs to ensure reliable version creation and proper validation:UI and API Creation:
  • Resolved an issue that prevented users from creating new versions via the API Designer’s Manage Versions screen
  • Added validation for the base_api_id parameter - providing a non-existent ID would previously create the API successfully, but leave it invisible in the Dashboard UI
  • Added stricter validation for version names - users can no longer create API versions without specifying a valid new_version_name, preventing unusable or empty version entries
  • Improved error messaging when the base_api_version_name parameter is missing or incorrectly specified
Version Management:
  • Fixed an issue where creating new child versions would incorrectly reset the default version back to the base API, overriding previously configured settings
The system now provides comprehensive validation with clear error responses (HTTP 400 Bad Request and HTTP 422 Unprocessable Entity), ensures that all API versions have meaningful identifiers, and maintains proper default version settings during the creation of child versions.
Fixed an issue where the Tyk Dashboard did not correctly apply a default page_size value when none was specified in the Dashboard configuration, potentially causing unexpected pagination behavior. The Dashboard now properly defaults to a page size of 10 items as documented, ensuring consistent and predictable pagination across all Dashboard views.
Fixed an issue where updates to global webhooks were not immediately applied to Tyk OAS APIs using those webhooks. When global webhook configurations were modified, the Gateway would continue using the previous settings for affected Tyk OAS APIs until a manual reload occurred. The system now automatically triggers a Gateway reload for all impacted Tyk OAS APIs when global webhook configurations are updated, ensuring that the new webhook settings take effect immediately.
Security Fixes

​
5.8.5 Release Notes

​
Release Date 18th August 2025

​
Release Highlights

This release fixes a compatibility issue between MDCB and Dashboard where APIs containing dots (.) in their paths were not handled correctly in MDCB. API definitions are now processed consistently with the Dashboard, ensuring middleware works as expected across all gateways. For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools
Given the potential time difference between your upgrade and the release of this version, we recommend users verify the ongoing support of third-party dependencies they install, as their status may have changed since the release.

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

To resolve the compatibility issue between MDCB and Tyk Dashboard when OAS API definition paths contain dot (.) characters, you can choose one of the following upgrade paths:
Recommended Upgrade Paths
  1. Upgrade Dashboard (Preferred)
    • Upgrade to Dashboard v5.8.5 to resolve the issue.
    • In this version, escape_dots_in_oas_paths defaults to false, and the Dashboard automatically unescapes dots in all API definitions.
    • No MDCB upgrade is required.
  2. Upgrade MDCB to v2.8.4 (Alternative if you cannot upgrade the Dashboard)
    • Enable escape_dots_in_oas_paths in both Dashboard and MDCB configurations.
    • This ensures consistent escaping/decoding of dots across all components.
If you are upgrading to 5.8.5, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed

​
5.8.4 Release Notes

​
Release Date 13th August 2025

​
Release Highlights

For a comprehensive list of changes, please refer to the detailed changelog.

​
Breaking Changes

Since 5.8.3, Tyk Dashboard automatically escapes dots (.) in OpenAPI endpoint paths (e.g., /v1.0 becomes /v1\u002e0) before saving to the database. This was introduced to support DocumentDB users as explained in the change log. MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.8.4 and is fixed in version Dashboard version 5.8.5 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.4, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed

​
5.8.3 Release Notes

​
Release Date 15th July 2025

​
Release Highlights

This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

Tyk Dashboard now automatically escapes dots (.) in OpenAPI endpoint paths (e.g., /v1.0 becomes /v1\u002e0) before saving to the database. This was introduced to support DocumentDB users as explained in the change log. MDCB 2.8.3 and earlier fails to properly decode these escaped paths when reading from the database. This causes the Validate Request and Mock Response middleware to malfunction for endpoints where the path contains dots; other middleware continues to work. The issue affects all MDCB deployments with Dashboard 5.8.3 and is fixed in version Dashboard version 5.8.5 and MDCB version 2.8.4. We strongly recommend that users upgrade to the latest versions of Tyk components.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.3, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed
Fixed an issue where the automatic configuration options (authentication, mock response, etc) had no effect when creating an API from an OpenAPI document if the listenPath was not also specified via query parameter.
Fixed an issue where the Search function did not work correctly on the Traffic Activity by Key page that was observed only when using MongoDB for analytics storage. This was due to the specific syntax required by MongoDB for regular expressions.
Fixed an issue where endpoints that contain dots in the path name failed with an error when creating or updating an API. The issue was caused by the underlying storage not accepting dots as valid URI characters and was observed only with DocumentDB.
Fixed an issue where API Categories and Ownership could be lost when applying an updated OpenAPI description to a Tyk OAS API.
Fixed an issue where some middleware (API-level rate limit and mock response) were not triggered correctly when using the Tyk OAS API designer’s built in debugger to test APIs.
Fixed an issue that occurred when converting Tyk Classic API definitions to Tyk OAS format, which could result in unnecessary empty fields in the Tyk OAS API definition.
Fixed an issue where the Tyk OAS API designer did not always display all of the appropriate certificates for use in Gateway to Upstream connections. In this scenario Tyk is the client and so requires the private key to sign requests to the upstream server. The full list of certificates with private keys registered in the Tyk Certificate Store will now be available when configuring your API.For Dashboard API users, we’ve added a new optional filter query parameter to the /api/certs endpoint that will can be used to retrieve a subset of the certificate based on the presence of a Private Key (PK):
  • omit: (Default) Returns all certificates.
  • with_pk: Returns only certificates that include a Private Key.
  • without_pk: Returns only certificates that do not include a Private Key.
For example:
  • To retrieve the first page of certificates: /api/certs?mode=detailed&p=1
  • To retrieve the first page of certificates with a Private Key: /api/certs?mode=detailed&p=1&filter=with_pk
  • To retrieve the first page of certificates without a Private Key: /api/certs?mode=detailed&p=1&filter=without_pk
This new filtering capability provides more granular control over which certificates you retrieve from the Tyk Certificate Store. There is no change in behaviour if the filter parameter is omitted.
We’ve fixed an issue when importing OpenAPI descriptions using the PATCH method, so you can now update your Tyk OAS APIs using either YAML or JSON formatted OpenAPI descriptions.
Fixed an issue where Dashboard did not correctly import Tyk Streams API definitions, skipping validation of the configuration.
Fixed an error in the Tyk OAS API Designer that added invalid config to the API definition when enabling Tyk OAuth 2.0 authentication method for an API that has an OAuth configuration in the OpenAPI description’s securitySchemes.
Fixed some issues when using the API Definition Editor to view and modify Tyk Streams APIs.
We have implemented various fixes and improvements in the Dashboard UI to enhance usability.
  • The Tyk OAS API designer now fully supports the use of Key-Value storage references that are valid in the API definition.
  • Improved the error messages displayed in the Dashboard UI when there are problems importing OpenAPI documents - now they clearly explain the issue and provide guidance on how to resolve it.
  • Fixed an issue where users couldn’t register Event Handlers in Tyk OAS API Designer.

​
5.8.2 Release Notes

​
Release Date 1st July 2025

​
Release Highlights

This is a version bump to align with Gateway v5.8.2, no changes have been implemented in this release.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.2, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes in this release.

​
5.8.1 Release Notes

​
Release Date 9 May 2025

​
Release Highlights

This patch release contains various bug fixes. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed
Fixed an issue where the Dashboard might not allow the correct number of Gateways to connect. This was due to a conflict with license management in deployments with multiple Dashboards which has now been resolved.
Fixed an issue where existing admin users could have their permissions overwritten by SSO group settings during login. Admin users now retain their original permissions when sso_enable_user_lookup is enabled. Group permissions are only applied to new or non-admin users.
Fixed an issue that prevented creation of an API from a YAML format Tyk OAS API definition. You can now export your Tyk OAS API definition in YAML or JSON format and use the content of this file to create a new API.
Fixed an issue when using API Designer to migrate an API from Tyk Classic to Tyk OAS. Previously the cancel button did not work in the pop-up when promoting a staged API.
Fixed an issue that prevented import of multi-part OpenAPI descriptions in YAML format.
We have implemented various fixes and improvements in the Dashboard UI to enhance usability.
Security Fixes

​
5.8.0 Release Notes

​
Release Date 28 March 2025

​
Release Highlights

With Tyk 5.8.0 we are delighted to unlock the power and flexibility of Tyk OAS for all users, with full feature parity with the legacy Tyk Classic style for REST APIs. We are thrilled to announce new updates and improvements in Tyk 5.8.0, delivering more control, flexibility, and performance. For a comprehensive list of changes, please refer to the detailed changelog below.
Full support for API configuration using Tyk OAS
We have completed the journey with Tyk OAS that started back in Tyk 4.1 - and now anything that you can configure using the Tyk Classic API definition is also available in the Tyk OAS API definition. Tyk OAS is now the recommended API style for all REST services, with Tyk Classic recommended for use only for GraphQL and TCP services. With Tyk OAS we combine the industry standard OpenAPI description with the Tyk Vendor Extension, which encapsulates all of the Tyk Gateway settings that cannot be inferred from the OpenAPI Specification (OAS). You can keep your service description (OAS) as source of truth and update the OpenAPI description part of a Tyk OAS API independently from the Tyk Vendor Extension - no need to unpick distributed vendor extensions from your OAS. For more details, please see the documentation. Now that we have achieved this milestone we are keen to support users in migrating their existing Tyk Classic API portfolio to Tyk OAS and offer methods to do this both within the Tyk Dashboard Classic API Designer and via the Tyk Dashboard API. For more details of the migration tool, please see the documentation.
Enhanced upstream authentication
We are pleased to introduce advanced options for your Tyk OAS APIs when it comes to authenticating with the upstream service - a critical feature for integration with many partner services. With Tyk 5.8.0 you are now able to configure Tyk to act as an OAuth 2.0 client, retrieving an access token via the Client Credentials grant method. For legacy integrations Tyk can also support OAuth 2.0 Resource Owner Password Credentials grant and Basic Authentication methods. For more details please see the documentation.
Enhanced user experience within the Tyk Dashboard API Designer
To accompany the launch of fully featured Tyk OAS capabilities, we have made a raft of improvements in the Tyk Dashboard GUI. There’s an all-new API test and debug facility in the API designer, allowing you to issue requests to your APIs and then examine the debug traces produced by the Gateway without leaving the Tyk Dashboard. Our new, enhanced code editor allows you to work in YAML or JSON. We’ve also given the UI a spring clean to improve the usability.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.8.0, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Tyk Dashboard’s API and UI now support both YAML and JSON for Tyk OAS CRUD operations, giving users greater flexibility in managing their APIs.
We’ve enhanced Tyk’s OpenAPI handling to allow the import of multi-part OpenAPI documents. This allows users to import OpenAPI descriptions that are split across multiple files, making it easier to manage complex API specifications.
We’ve added built-in testing and debugging capabilities to the Tyk OAS API Designer, making validating and troubleshooting your APIs easier. With a floating debugging panel and an endpoint dropdown, you can test your endpoints within the Dashboard UI.
Users can now configure separate RDS endpoints for read and write operations, optimizing database performance by handling reads on replicas and writes on the primary instance.New Configuration Fields:
  • ReadConnectionString: Defines the connection string for read operations. It is only used if ConnectionString is not set.
  • WriteConnectionString: Defines the connection string for write operations. It is only used if ConnectionString is not set.
For backward compatibility, if ConnectionString is set, it will take precedence over the new fields.
When creating a GraphQL API in the API designer, you can now attach certificates to be used during introspection of mTLS-protected upstream services. This simplifies the creation of GraphQL APIs by reducing the number of steps, as previously you had to use a dummy upstream during the initial creation and then reconfigure the API to perform introspection later.
Introduced a new API migration facility to the Tyk Dashboard API and API Designer enabling a seamless transition from Tyk Classic to Tyk OAS. Both methods offer direct and staged conversions of individual APIs. The Tyk Dashboard API also supports bulk API conversions.Note that there is a known issue where the Cancel button in the Promote Staged API confirmation modal does not function. If you select Promote Staged API but decide not to proceed, you will need to use your browser’s Back button to exit the modal. This issue will be resolved in the next patch.
Tyk Dashboard now supports integration with upstream services secured using Basic Auth, OAuth 2.0 Client Credentials, and OAuth 2.0 Password Grant in Tyk OAS APIs, providing flexibility in securing upstream authentication flows.
We have introduced a guided onboarding experience for Tyk Cloud users to help new users start effortlessly. Our step-by-step guide walks you through creating your first API, setting up policies and keys, testing endpoints, and exploring analytics - ensuring you can navigate the Dashboard and unlock its full potential from day one.
Tyk Dashboard now provides enhanced visibility into user activity by allowing audit logs to be stored in a database and viewed directly in the Dashboard UI. Previously, these logs were only written to local files, limiting accessibility. With this update, admins can filter and review user actions more easily, improving security, and compliance tracking.
Changed
The Dashboard now supports PostgreSQL 17, ensuring compatibility with the latest database version.
Tyk Dashboard now runs on Golang 1.23, bringing security and performance improvements. Key changes include:
  • unbuffered Timer/Ticker channels
  • removal of 3DES cipher suites
  • updates to X509KeyPair handling.
You may need to adjust your setup for compatibility. For more details, please see the official Go release notes.
Upgraded the code editor component library and enhanced its styling for a better user experience. With this upgrade comes the facility to work in YAML or JSON and to switch seamlessly between formats.
We have made minor adjustments to labels within the Dashboard UI to enhance clarity.
We’ve optimized form validation in the API Designer to enhance user experience. Forms are now validated on blur instead of during every keystroke, preventing cursor jumps and improving typing responsiveness.
Modified the default values of allow_explicit_policy_id and enable_duplicate_slugs to true in the example Dashboard configuration file, to eliminate config problems when deploying Tyk Sync and Tyk Operator. This has no impact on existing deployments.
Removed unsupported TLS versions 1.0 and 1.1 from the Tyk Classic API Designer selector, improving clarity around supported TLS versions and enhancing security.
Fixed

​
5.7 Release Notes

​
5.7.3 Release Notes

​
Release Date 05 June 2025

​
Release Highlights

This is a version bump to align with Gateway v5.7.3, no changes have been implemented in this release.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.7.3, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes in this release.

​
5.7.2 Release Notes

​
Release Date 19 February 2025

​
Release Highlights

This release focuses mainly on a security fix. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release

​
Upgrade instructions

If you are upgrading to 5.7.2, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes have been implemented in this release.
Fixed
Security Fixes

​
5.7.1 Release Notes

​
Release Date 31 December 2024

​
Release Highlights

This release focuses mainly on bug fixes. For a comprehensive list of changes, please refer to the detailed changelog below.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

We have deprecated the obsolescent http_server_options.prefer_server_ciphers configuration option. This legacy control no longer has any effect on the underlying library and users are advised to remove this setting from their configurations.

​
Upgrade instructions

If you are upgrading to 5.7.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Fixed

​
5.7.0 Release Notes

​
Release Date 03 December 2024

​
Release Highlights

We are thrilled to announce new updates and improvements in Tyk 5.7.0, bringing more control, flexibility, and performance. For a comprehensive list of changes, please refer to the detailed changelog below.
Tyk Streams can be configured through Tyk Dashboard
With this release we are adding a possibility for users to configure their Stream & Events APIs using Tyk Dashboard. The new API designer leads users step-by-step to create a new Stream configuration easily. Pre-filled stream configurations for different inputs and outputs make it easy to make sure that the Stream is configured correctly.
Improved Audit Log Management
Tyk 5.7.0 enhances Audit Log management with new features designed for efficiency and security. Users can now store Dashboard Audit Logs in a database for persistent retention and access them via the new /audit-logs API, which supports advanced filtering by attributes like action, IP, status, and user. Additionally, a dedicated Audit Log RBAC group ensures secure access to sensitive log data. These improvements simplify monitoring and compliance workflows, particularly in containerized environments.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

This section highlights features and dependencies that have been deprecated.
Authentication Methods
We’ve deprecated the following authentication methods in this release:
  • External OAuth
    • Tyk Classic: external_oauth
    • Tyk OAS: server.authentication.securitySchemes.externalOAuth
  • OpenID Connect (OIDC)
    • Tyk Classic: auth_configs.oidc
    • Tyk OAS: server.authentication.oidc
We recommend migrating to JWT Authentication for improved flexibility and long-term support.
SQLite End of Life
SQLite has reached End of Life for the Tyk Dashboard in this release. It was previously intended for proof-of-concept use only and is no longer supported. We now recommend using PostgreSQL or MongoDB for both development and production deployments, as they provide greater scalability and long-term support. Why This Matters
  • SQLite is written in C, and using it in Go projects typically requires CGO, which enables Go code to call C libraries.
  • As long as the Dashboard had support for SQLite, CGO was required.
  • With SQLite removed, the Tyk Dashboard can now be compiled with CGO_ENABLED=0, resulting in a fully static binary.
This change enables:
  • Easier cross-platform builds
  • Better compatibility with RHEL8
  • Fewer dependencies and improved portability

​
Upgrade instructions

If you are upgrading to 5.7.0, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Introduced a confirmation prompt when deleting a stream, notifying users that this action will stop all data streaming and cannot be undone. This change ensures users are fully aware of the impact before proceeding with deletion.
Added “Streams” as an API type in the API Overview table, making it easier for API developers to identify APIs categorised as Streams & Events.
Added logic for the Streaming API creation process, allowing users to select config frameworks for inputs, processors, and outputs. An ‘Advanced’ option is also available, which leaves the code editor empty while generating and displaying the YAML Bento config based on the user’s selections.
Included new info messages and tooltips in the Policies & Keys section to guide users on securing Streaming & Events APIs. Updated messaging clarifies the combination of API types and revised copy in the Global Rate Limiting and Quota sections to better explain usage limits for keys and plans.
Enabled URL view and copy functionality in the External Playgrounds tab, supporting scenarios with multiple organisations and URLs for playgrounds.
Rolled out the /streams endpoint to the Tyk Dashboard API, dedicated to creating Stream and Events APIs in Tyk Streams. Documentation for the endpoint and its methods is available in the Tyk Docs.
Separated Streaming API into its own type in the API Designer, introducing a new selection card for easier creation and configuration. Navigation enhancements, including a shortcut menu item, provide quicker access to the streaming configuration UI.
Developed a step-by-step UI for Streaming API creation, enabling users to select a config framework for inputs, processors, and outputs. The dynamic wizard steps are integrated into the Tyk UI library to prefill configurations based on selections and prevent the combination of ‘Custom’ with other frameworks.
Introduced a form on the Tyk Dashboard that allows users to easily contact Tyk support during their trial period.
We have enhanced security for customers in highly regulated industries by introducing JSON Web Encryption (JWE) support for OIDC single sign-on (SSO). This ensures that tokens used in authentication flows are securely encrypted, providing an additional layer of protection.Setup guide for JWE OIDC SSO
Users can now choose to store Dashboard Audit Logs directly in a database, enabling efficient and reliable log storage. This feature is particularly beneficial for organizations needing persistent audit log retention to meet compliance requirements or for forensic purposes.
A new API endpoint, /audit-logs, has been introduced to provide programmatic access to audit logs stored in database. This allows users to retrieve, filter, and analyze logs more effectively. The API supports filtering logs by key attributes like action, IP address, URL accessed, date range, user, and page number.For detail usage of the /audit-logs endpoint, please see Dashboard API documentation.
To secure access to audit logs, we’ve added a new Audit Log RBAC group. This ensures that only authorized users can view or retrieve sensitive log information. Administrators can assign this permission as part of their security and compliance strategy.
Changed
Eliminated AJV validation in the Streams Config Editor to prevent false positives on valid YAML configurations. The frontend now solely checks the YAML structure, providing users with greater flexibility without enforcing strict Bento-specific schema rules
Removed an unnecessary field from the API Designer page under the Streams section to enhance clarity. This update impacts the Event Handlers, Detailed Activity Logs, Caching, and Endpoints tabs.
Tyk will now detect path-level parameters in the OpenAPI description and can be set to enable and configure the Request Validation middleware automatically for these. Previously this automatic detection only worked for method-level parameters in the OpenAPI description.
Removed SQLite support to enhance portability and security, ensuring the released binary can now be built statically and no longer relies on system libraries. This change supports continued compatibility with RHEL8.
The External OAuth and OpenID Connect authentication options have been deprecated in the Tyk Dashboard. Users are advised to utilize JWT Auth with external IDPs for a more complete integration, while existing functionality remains operational to avoid breaking changes.
Updated NPM package dependencies of Dashboard, to address security vulnerabilities.
Fixed
Resolved an issue where the “Back to APIs Page” button was unresponsive on the Streams API page. The button now correctly redirects users to the main APIs page for all API types.
Corrected an issue where the search box on the Tyk OAS and Streams API pages only accepted a single character. Users can now input complete search terms, allowing for more accurate searches.
Fixed an issue with the user group dropdown in the Dashboard UI, ensuring that all available user groups are displayed when creating a new user.

​
5.6 Release Notes

​
5.6.1 Release Notes

​
Release Date 18 October 2024

​
Release Highlights

This is a version bump to align with Gateway v5.6.1, no changes have been implemented in this release.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.6.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes in this release.

​
5.6.0 Release Notes

​
Release Date 10 October 2024

​
Release Highlights

We are thrilled to announce new updates and improvements in Tyk 5.6.0, bringing more control, flexibility, and performance. For a comprehensive list of changes, please refer to the detailed changelog below.
Per endpoint Rate Limiting for clients
Now you can configure rate limits at the endpoint level per client, using new configuration options in the access key. Use Policies to create templates to set appropriate rate limits for your different categories of user.
Go upgrade to 1.22
We’ve upgraded the Tyk Dashboard to Golang 1.22, bringing improved performance, better security, and enhanced stability to the core system.
Strengthened Role-Based Access Controls (RBAC) to combat privilege escalation risks
We’ve tightened up the rules that govern a user’s ability to create admin users and to reset other users’ passwords when using Tyk’s RBAC function. Now, only super-admins can create new admins, admin roles can’t be assigned to user groups, and only admin users can reset another user’s password (and only within their Tyk organization).

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

We are deprecating support for SQLite, External OAuth Middleware, and OpenID Connect (OIDC) Middleware in Tyk Dashboard to simplify the platform and enhance overall performance. These changes will take effect from 5.7.0.

​
Why the Change?

​
SQLite

While useful for testing, SQLite is not designed for production environments. By focusing on PostgreSQL and MongoDB, we can provide users with more scalable and reliable options.

​
External OAuth Middleware

This feature serves a similar purpose to our JWT Authentication and may lead to confusion. We recommend transitioning to JWT Authentication for a more streamlined experience.

​
OpenID Connect (OIDC) Middleware

The low adoption of this option, along with its functional overlap with other supported authentication methods, prompts us to deprecate OIDC middleware to reduce complexity within the platform. We recommend users transition to JWT Authentication. We encourage users to switch to the recommended alternatives. For more detailed information, please refer to the Documentation

​
Upgrade instructions

If you are upgrading to 5.6.0, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Changed
The Tyk Dashboard has been upgraded from Golang 1.21 to Golang 1.22, bringing enhanced performance, strengthened security, and access to the latest features available in the new Golang release.
We have updated the swagger.yml schema for Tyk Dashboard API to reflect the latest changes in product endpoints, payloads, and responses. This update includes new fields and endpoints, improved examples, documentation adjustments, and fixes for schema issues. These enhancements aim to improve usability and ensure that the documentation accurately represents the current code state.
The “Playground” tab in the GraphQL API Designer has been renamed to “Playgrounds.” This change consolidates access to both internal and external playgrounds within a single section, offering a more streamlined and intuitive experience for API design and testing.
Fixed
  • Resolved an issue where HTTP 429 status codes were not being displayed on the Activity Overview page.
  • Fixed portal graphs by adding a default “day” grouping resolution to the query.
  • Corrected issues with the Error Breakdown related to date parameters, ensuring accurate date handling and display.
We have resolved an issue where the Keys page would display a blank screen if a key was associated with more than 10 policies. The UI has been fixed to display the page properly, regardless of the number of policies attached to a key.
When working with Tyk Classic APIs, you cannot permit access to multiple versions of the same API from a single policy. We have fixed an issue in the Dashboard UI where users were able to attach multiple versions to a policy leading to an unusable policy. The UI now correctly prevents the addition of multiple versions of an API to a single policy.
We have fixed an issue in the Dashboard UI when assigning multiple claim to policy mappings while configuring JWT auth for an API. The scope name was incorrectly recorded instead of the policy ID for the second and subsequent JWT scope mappings. The UI now correctly associates the defined claim with the appropriate policy, ensuring accurate JWT scope to policy mappings.
We have fixed an issue in the Monitoring section of the Dashboard UI where the Gateway logs page was not displaying correctly. The page is now rendered properly, ensuring users with appropriate permissions can view and manage Gateway logs as expected.

​
5.5 Release Notes

​
5.5.2 Release Notes

​
Release Date 03 October 2024

​
Release Highlights

This release replaces Tyk Dashboard 5.5.1 which was accidentally released as a non-distroless image.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.5.2, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes in this release.

​
5.5.1 Release Notes

​
Release Date 26 September 2024

​
Release Highlights

This is a version bump to align with Gateway v5.5.1, no changes have been implemented in this release.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.5.1, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

No changes in this release.

​
5.5.0 Release Notes

​
Release Date 12 August 2024

​
Release Highlights

We are excited to announce Tyk Dashboard 5.5, featuring a brand-new dashboard identity, advanced rate-limiting capabilities, and enhanced security options. For a comprehensive list of changes, please refer to the changelog below.
New Tyk brand identity
Experience a refreshed and modern look with our updated brand identity. The new design enhances usability and provides a cleaner, more intuitive interface for managing your APIs.
Per Endpoint Rate Limiting
Now configure rate limits at the endpoint level for both Tyk OAS and Tyk Classic APIs, providing granular protection for upstream services against overloading and abuse.

​
Breaking Changes

There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.5.0, please follow the detailed upgrade instructions.

​
Downloads

​
Changelog

Added
Rate limits can now be configured at the endpoint level in Tyk OAS and Tyk Classic API definitions. Configure these new more granular controls from the API Designer.
When configuring API versioning settings for Tyk OAS APIs, you can now set a Version Identifier Pattern when using the URL path to indicate the API version (for example /v1/my-api). This will be used to avoid accidentally stripping part of the target URL (and failed upstream proxy) if the client doesn’t provide any version identifier. If you’re using Tyk Classic APIs you can set the url_versioning_pattern field in the API definition using the raw API editor.
We’ve expanded the functionality of the schema editor for GQL APIs. Users can now easily import their schema from a file, export it, or quickly clean the entire editor if a mistake is made.
Changed
Fixed
Addressed a problem where Response Plugins were not being invoked for Tyk OAS APIs.
Addressed an issue for SSO users where user permissions were not correctly applied. This led to the Save API button not being visible to all appropriate users in the API Designer.
Resolved an issue where the Public GQL Playground displayed schema information despite introspection being turned off. Now, schema details are hidden unless valid authentication credentials are provided, ensuring a secure and consistent user experience.
Addressed an issue where the Dashboard displayed a blank pane when accessing the Activity by Endpoint page after upgrading to Tyk 5.3.1.
Security Fixes

​
5.4 Release Notes

​
5.4.0 Release Notes

​
Release Date 2 July 2024

​
Breaking Changes

Attention: Please read this section carefully There are no breaking changes in this release.

​
Dependencies

Compatibility Matrix For Tyk Components
3rd Party Dependencies & Tools

​
Deprecations

There are no deprecations in this release.

​
Upgrade instructions

If you are upgrading to 5.4.0, please follow the detailed upgrade instructions. Add upgrade steps here if necessary.

​
Release Highlights

We’re thrilled to introduce exciting enhancements in Tyk Dashboard 5.4, aimed at improving your experience with Tyk Dashboard. For a comprehensive list of changes, please refer to the change log below.

​
Event handling for Tyk OAS APIs

We’ve added support for you to register webhooks with your Tyk OAS APIs so that you can handle events triggered by the Gateway, including circuit breaker and quota expiry. You can also assign webhooks to be fired when using the new smoothing rate limiter to notify your systems of ongoing traffic spikes. For more details see the documentation.

​
Enhanced Header Handling in GraphQL APIs

Introduced a features object in API definitions for GQL APIs, including the use_immutable_headers attribute. This allows advanced header control, enabling users to add new headers, rewrite existing ones, and selectively remove specific headers. Existing APIs will have this attribute set to false by default, ensuring no change in behavior. For new APIs, this attribute is true by default, facilitating smoother migration and maintaining backward compatibility.

​
Downloads

​
Changelog

Added