--- title: "Workspace token management, password rotation for HA databases, tracing in the CLI" date: 2026-11-05T23:28:00.000Z number: 0315 url: https://railway.com/changelog/2026-11-06-workspace-token-management --- # Workspace token management, password rotation for HA databases, tracing in the CLI This week, we're giving you more control over workspace credentials and bringing request tracing to your terminal. Review your team's tokens, rotate passwords across HA database clusters, and investigate failing requests without leaving your CLI. # Workspace token management ![Review every workspace token and revoke the ones you no longer need](https://cms.railway.com/media/304e56e3-f11c-4451-ab67-2ea34d56b589-CleanShot-2026-11-07-at-12.24.20-AM-2x.png) Workspace tokens power shared automation, but managing them used to depend on whoever created them. Only that person could see or revoke their tokens. Workspace admins can now open [Workspace Settings → Tokens](https://railway.com/workspace/tokens) to review every workspace token, see who created it and when, and revoke tokens the team no longer needs. Token creation and revocation also appear in your workspace's [audit logs](https://docs.railway.com/enterprise/audit-logs). To create a workspace token, open [Account Settings → Tokens](https://railway.com/account/tokens) and select your workspace in the **Workspace** dropdown. Take a look at your workspace's tokens, and share your feedback on [Central Station](https://station.railway.com/new?type=feedback). # Password rotation for HA databases [Regenerate credentials of your highly available databases](https://cms.railway.com/media/f73b3584-d0fa-4b7e-9b40-315b39dfe508-rotate-creds-postgres.mp4) Password regeneration is available for HA clusters running Postgres, MySQL, Redis, and MongoDB. Previously, HA password regeneration required Priority Boarding. MongoDB HA remains in Priority Boarding. Open your database's **Config** tab, find the **Connection** section, and click **Regenerate** next to **Regenerate Password**. Railway coordinates the password change across cluster members, updates the proxies, and redeploys running services that reference the password through Railway variables. The dashboard shows progress throughout the rotation. Cluster members adopt the password without restarting, though older image builds require a redeploy first. If the primary needs that update, a failover causes a brief write interruption. If rotation fails before the password is committed, Railway restores the previous password. After that point, the dashboard identifies anything that still needs a redeploy. You'll need to update hardcoded credentials and applications outside Railway yourself. Read the [HA rotation documentation](https://docs.railway.com/databases/database-view#regenerate-on-a-high-availability-cluster), and tell us how it goes on [Central Station](https://station.railway.com/new?type=feedback). # Tracing in the CLI [Enable tracing, find a failing request, and inspect its spans with railway trace](https://cms.railway.com/media/28b7f3c0-f419-4a4c-853c-be1a6e0c3a61-railway-trace-cli.mp4) Follow a request from Railway's edge through your services and database calls, right from your terminal. `railway trace` brings tracing setup and investigation out of the dashboard and into your CLI. Enable tracing with `railway trace enable`, add `--auto-instrument` to turn on automatic instrumentation, and check settings with `railway trace status`. When something goes wrong, `railway trace list --errors --since 2h` finds recent failing requests. Use `railway trace get ` to inspect a request's spans as a tree, with durations and statuses to help locate the problem. Your coding agent can use the same commands to investigate requests. Every command supports `--json` for structured output, plus `--service` and `--environment` to select your target. Tracing is in preview. The dashboard's **Traces** page requires Priority Boarding, while the CLI commands are available to everyone. Update with `railway upgrade`, read the [trace command reference](https://docs.railway.com/cli/trace), and share your feedback on [Central Station](https://station.railway.com/new?type=feedback). # Fixes and improvements - We improved stopped deployment tracking. The activity feed shows a **Deployment stopped** entry, and project history records who stopped it and when. Previously, manually stopped deployments looked the same as containers that exited on their own. - We shipped `--environment` for [`railway config plan`, `apply`, and `pull`](https://docs.railway.com/cli/config). You can target another environment without relinking your project first. - We shipped [`railway config partials list`, `release`, and `transfer`](https://docs.railway.com/cli/config#manage-partial-ownership) to inspect and reassign ownership of resources managed through infrastructure as code. Ownership could previously remain after its authoring file was removed and block reassignment. You can manage that ownership without the original file or a redeploy.