Providers / Railway
Hosting
Railway API keys and credentials
What every Railway credential a founder holds does, whether it expires, and what tends to break. Each fact links to Railway's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Account token (no workspace selected) | Not documented | Full access only |
| Workspace (team) token | Not documented | Can be scoped |
| Project token | Not documented | Can be scoped |
| Railway account login | Not documented | – |
Each credential
Account token (no workspace selected)
- Not documented
- Full access only
Created in account settings > Tokens with 'No workspace' selected. Broadest token: it can perform any API action the account is authorized for, across all workspaces. Sent as Authorization: Bearer. The 'me' query works only with account tokens. Docs do not state an expiry or describe fine-grained permissions. Do not share it.
Workspace (team) token
- Not documented
- Can be scoped
Created on the Tokens page by choosing a workspace. Covers all resources in that one workspace; it cannot reach personal resources or other workspaces. Shareable with teammates. Sent as Authorization: Bearer. Older docs call this a team token. Expiry not stated.
Project token
- Not documented
- Can be scoped
Created in project settings > Tokens. Limited to one environment within one project. Must be sent in the Project-Access-Token header, not Authorization: Bearer. Expiry not stated.
Railway account login
- Not documented
Dashboard sign-in (may be GitHub or email based). Not an API credential. Session policy not researched.
What usually goes wrong
- Account token pasted into a CI variable or shared channel; it grants access to every workspace the account belongs to
- Project token sent in the Authorization header instead of Project-Access-Token, so requests are rejected
- Token deleted while a deployment pipeline still uses it, breaking automated deploys
Renewals and billing
- Railway plan. Plan and billing cadence not researched. Usage-based charges may apply.
Not researched.
Where to find it in Railway
What Railway's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Expiry and default lifetime for account, workspace, and project tokens (neither docs page states one)
- Whether token expiry is readable via API
- Immediate revocation on deletion (railway.com/auth.md was only seen in search results, not fetched)
- Whether the Railway account is linked to a GitHub login, and its session policy
- Billing model, usage API, and plan cadence
Rotating or replacing a Railway key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- docs.railway.com/guides/public-api
- docs.railway.com/reference/public-api
- docs.railway.com/integrations/api/manage-variables
- docs.railway.com/guides/variables
- docs.railway.com/enterprise/audit-logs
- docs.railway.com/pricing/plans
- docs.railway.com/pricing/faqs
Related providers
Keep track of every Railway key
StackHangar stores your Railway keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.