Skip to content

[TT-17927] Update documentation for master #2796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
probelabs wants to merge 6 commits into
base: main
Choose a base branch
from
Open

[TT-17927] Update documentation for master #2796

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4afdc4f
Import config/docs
jay-deshmukh Aug 25, 2026
ac5ec5a
Merge main into update/TT-17927/release-main-docs
probelabs[bot] Aug 25, 2026
b6f0920
Merge main into update/TT-17927/release-main-docs
probelabs[bot] Aug 26, 2026
d9e69a6
Merge main into update/TT-17927/release-main-docs
probelabs[bot] Aug 27, 2026
ac9cfe7
Merge main into update/TT-17927/release-main-docs
probelabs[bot] Aug 27, 2026
1eb36b6
Merge main into update/TT-17927/release-main-docs
probelabs[bot] Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
181 changes: 158 additions & 23 deletions snippets/dashboard-config.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,30 @@

disables implicit prepared statement usage

### storage.main.postgres.max_open_connections
ENV: <b>TYK_DB_STORAGE_MAIN_POSTGRES_MAXOPENCONNECTIONS</b><br />
Type: `int`<br />

Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.

Check warning on line 165 in snippets/dashboard-config.mdx

View check run for this annotation

probelabs / Visor: security

security Issue 

The documentation for `storage.main.postgres.max_open_connections` specifies a default value of `0`, which signifies unlimited open connections to the database. This is an insecure default that can lead to resource exhaustion on the database server, creating a Denial of Service (DoS) vulnerability. The same issue is present for the `analytics`, `logs`, and `uptime` storage configurations.
Raw output 
Update the documentation to recommend a specific, safe, non-zero default value for `max_open_connections`. Alternatively, add a prominent warning advising administrators to configure a sensible limit based on their database capacity and expected load to mitigate the risk of resource exhaustion.

### storage.main.postgres.max_idle_connections
ENV: <b>TYK_DB_STORAGE_MAIN_POSTGRES_MAXIDLECONNECTIONS</b><br />

Check warning on line 168 in snippets/dashboard-config.mdx

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The default value of 0 (unlimited) for `max_open_connections` can lead to database connection exhaustion under load. This setting is documented for `storage.main`, `storage.analytics`, `storage.logs`, and `storage.uptime`. In a production environment with multiple Tyk Dashboard replicas, an unlimited number of connections can overwhelm the PostgreSQL server, causing severe performance degradation. The documentation should warn users about this risk.
Raw output 
For each `max_open_connections` field, add a recommendation to set a specific limit for production deployments. For example: 'For production environments, it is strongly recommended to set a limit based on your database capacity and number of Dashboard replicas to prevent connection exhaustion.'
Type: `int`<br />

Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.

### storage.main.postgres.connection_max_lifetime
ENV: <b>TYK_DB_STORAGE_MAIN_POSTGRES_CONNECTIONMAXLIFETIME</b><br />
Type: `string`<br />

Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.

### storage.main.postgres.connection_max_idle_time
ENV: <b>TYK_DB_STORAGE_MAIN_POSTGRES_CONNECTIONMAXIDLETIME</b><br />

Check warning on line 180 in snippets/dashboard-config.mdx

View check run for this annotation

probelabs / Visor: performance

performance Issue 

The default behavior of reusing connections forever (`connection_max_lifetime` is empty) can cause intermittent request failures in environments with stateful firewalls or load balancers that close idle connections. This applies to all four PostgreSQL storage configurations (`main`, `analytics`, `logs`, `uptime`). This can lead to poor performance and errors when the Dashboard attempts to use a connection that has been silently terminated by a network device.
Raw output 
For each `connection_max_lifetime` field, add a note advising users to set a lifetime shorter than any network infrastructure timeouts. For example: 'It is recommended to set this to a value like `30m` to prevent errors caused by network devices closing idle connections.'
Type: `string`<br />

Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.

### storage.main.mysql
Connection settings for a MySQL database

Expand Down Expand Up @@ -249,6 +273,30 @@

disables implicit prepared statement usage

### storage.analytics.postgres.max_open_connections
ENV: <b>TYK_DB_STORAGE_ANALYTICS_POSTGRES_MAXOPENCONNECTIONS</b><br />
Type: `int`<br />

Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.

### storage.analytics.postgres.max_idle_connections
ENV: <b>TYK_DB_STORAGE_ANALYTICS_POSTGRES_MAXIDLECONNECTIONS</b><br />
Type: `int`<br />

Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.

### storage.analytics.postgres.connection_max_lifetime
ENV: <b>TYK_DB_STORAGE_ANALYTICS_POSTGRES_CONNECTIONMAXLIFETIME</b><br />
Type: `string`<br />

Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.

### storage.analytics.postgres.connection_max_idle_time
ENV: <b>TYK_DB_STORAGE_ANALYTICS_POSTGRES_CONNECTIONMAXIDLETIME</b><br />
Type: `string`<br />

Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.

### storage.analytics.mysql
Connection settings for a MySQL database

Expand Down Expand Up @@ -337,6 +385,30 @@

disables implicit prepared statement usage

### storage.logs.postgres.max_open_connections
ENV: <b>TYK_DB_STORAGE_LOGS_POSTGRES_MAXOPENCONNECTIONS</b><br />
Type: `int`<br />

Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.

### storage.logs.postgres.max_idle_connections
ENV: <b>TYK_DB_STORAGE_LOGS_POSTGRES_MAXIDLECONNECTIONS</b><br />
Type: `int`<br />

Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.

### storage.logs.postgres.connection_max_lifetime
ENV: <b>TYK_DB_STORAGE_LOGS_POSTGRES_CONNECTIONMAXLIFETIME</b><br />
Type: `string`<br />

Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.

### storage.logs.postgres.connection_max_idle_time
ENV: <b>TYK_DB_STORAGE_LOGS_POSTGRES_CONNECTIONMAXIDLETIME</b><br />
Type: `string`<br />

Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.

### storage.logs.mysql
Connection settings for a MySQL database

Expand Down Expand Up @@ -428,6 +500,30 @@

disables implicit prepared statement usage

### storage.uptime.postgres.max_open_connections
ENV: <b>TYK_DB_STORAGE_UPTIME_POSTGRES_MAXOPENCONNECTIONS</b><br />
Type: `int`<br />

Maximum number of open connections to the database per connection pool. Dashboard maintains 8 connection pools. 0 (default) means unlimited.

### storage.uptime.postgres.max_idle_connections
ENV: <b>TYK_DB_STORAGE_UPTIME_POSTGRES_MAXIDLECONNECTIONS</b><br />
Type: `int`<br />

Maximum number of idle connections that will be kept in each connection pool. Dashboard maintains 8 connection pools. 0 (default) uses the Go default which is currently 2.

### storage.uptime.postgres.connection_max_lifetime
ENV: <b>TYK_DB_STORAGE_UPTIME_POSTGRES_CONNECTIONMAXLIFETIME</b><br />
Type: `string`<br />

Maximum length of time that a connection may be reused, as a Go duration string (e.g. "30m"). Empty (default) means connections are reused forever.

### storage.uptime.postgres.connection_max_idle_time
ENV: <b>TYK_DB_STORAGE_UPTIME_POSTGRES_CONNECTIONMAXIDLETIME</b><br />
Type: `string`<br />

Maximum length of time a connection may sit idle before being closed, as a Go duration string (e.g. "5m"). Empty (default) means idle connections are never closed for being idle.

### storage.uptime.mysql
Connection settings for a MySQL database

Expand Down Expand Up @@ -628,14 +724,47 @@

Set the number of maximum connections in the Redis connection pool, which defaults to 500. Set to a higher value if you are expecting more traffic.

### redis_iam_auth
RedisIAMAuth configures cloud IAM-based authentication for the Redis/Valkey
connection, using short-lived tokens instead of a static password.

### redis_iam_auth.provider
ENV: <b>TYK_DB_REDISIAMAUTH_PROVIDER</b><br />
Type: `string`<br />

Provider selects the cloud IAM provider. Currently supported: "gcp"
(GCP Memorystore for Valkey and Redis Cluster).

### redis_iam_auth.service_account
ENV: <b>TYK_DB_REDISIAMAUTH_SERVICEACCOUNT</b><br />
Type: `string`<br />

ServiceAccount, for GCP, optionally impersonates this service account to
mint tokens instead of using the ambient Application Default Credentials
identity. Leave empty to use the workload's own identity (Workload Identity
on GKE, or GOOGLE_APPLICATION_CREDENTIALS).

### redis_iam_auth.token_refresh_before_expiry
ENV: <b>TYK_DB_REDISIAMAUTH_TOKENREFRESHBEFOREEXPIRY</b><br />
Type: `string`<br />

The access token issued by the IAM will be refreshed before expiry.
Set the time period before expiry when that refresh will take place as
a human readable duration (for example "2m30s", "5m").
Defaults to "5m" (five minutes) when empty.

### redis_iam_auth.enabled
ENV: <b>TYK_DB_REDISIAMAUTH_ENABLED</b><br />
Type: `bool`<br />

Set to true to use IAM-based authentication for this storage connection.

### force_api_defaults
ENV: <b>TYK_DB_FORCEAPIDEFAULTS</b><br />
Type: `bool`<br />

If set to true, this forces the [listenPath.strip](/api-management/gateway-config-tyk-oas#listenpath) setting to true for all APIs created or updated through the Tyk Dashboard API or UI.

The default value is `false`

@sharadregoti sharadregoti Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add this back.


### notify_on_change
ENV: <b>TYK_DB_NOTIFYONCHANGE</b><br />
Type: `bool`<br />
Expand Down Expand Up @@ -1007,6 +1136,12 @@

ForbidAdminResetAccessToken is a security feature that allows you to prevent user admins from resetting the Dashboard API access tokens of other users. The default is `false`, however we recommend setting this to `true` for enhanced security.

### security.allowed_examples_urls
ENV: <b>TYK_DB_SECURITY_ALLOWEDEXAMPLESURLS</b><br />
Type: `[]string`<br />

AllowedExamplesURLs is a list of exact URLs that are allowed for fetching example API configurations. Only exact URL matches will be permitted when using the /api/examples endpoints. If not configured, defaults to official Tyk example repository URLs.

### ui
This section controls various settings for the look and feel of the Dashboard UI.

Expand Down Expand Up @@ -1076,27 +1211,6 @@
### ui.notifications
Notifications configures the behavior of toast notifications displayed in the UI.

### ui.notifications.duration

@sharadregoti sharadregoti Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we removing this?

Duration controls how long each class of toast notification is displayed.

### ui.notifications.duration.success
ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_SUCCESS</b><br />
Type: `int`<br />

Duration in milliseconds for success notifications.

### ui.notifications.duration.warning
ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_WARNING</b><br />
Type: `int`<br />

Duration in milliseconds for warning notifications.

### ui.notifications.duration.error
ENV: <b>TYK_DB_UI_NOTIFICATIONS_DURATION_ERROR</b><br />
Type: `int`<br />

Duration in milliseconds for error notifications.

### home_dir
ENV: <b>TYK_DB_HOMEDIR</b><br />
Type: `string`<br />
Expand Down Expand Up @@ -1436,9 +1550,30 @@
You can now configure the log format to be either the standard or json format
If not set or left empty, it will default to `standard`.

### log_level
ENV: <b>TYK_DB_LOGLEVEL</b><br />
Type: `string`<br />

Configure the log verbosity. Valid values are: debug, info, warn, error.
The system level TYK_LOGLEVEL takes precedence over this field when set.
If unset, defaults to info.

### allow_unsafe_policy_ids
ENV: <b>TYK_DB_ALLOWUNSAFEPOLICYIDS</b><br />
Type: `bool`<br />

AllowUnsafePolicyIds allows the use of non-standard characters in policy identifiers (default: false). The standard characters are alphanumeric characters plus underscore (_), hyphen (-), dot (.) and tilde (~). The use of other characters in IDs can cause unpredictable behavior and is not recommended.

### kv
ENV: <b>TYK_DB_KV</b><br />
Type: `kv.Config`<br />

KV defines named secret stores (such as HashiCorp Vault, Consul, environment
variables, or inline values) that other configuration values can reference.
This lets sensitive settings like database credentials or the admin secret
be kept in an external store instead of the config file; each referenced
value is resolved from its store once, at startup. Store definitions may be
set in the config file or supplied as a JSON object through the
TYK_DB_KV_STORES environment variable; the environment overrides and adds
stores by name, leaving file-defined stores it does not name untouched.

Loading
Loading