Deploy and Host Authentik on Railway

authentik is an open-source identity provider for single sign-on. It supports OAuth2 and OpenID Connect, SAML, LDAP, RADIUS and SCIM, proxy authentication for apps without login, MFA with TOTP, WebAuthn and passkeys, and customizable login flows. It is a self-hosted alternative to Okta, Auth0 and Keycloak.

About Hosting Authentik

This template runs the official authentik/server:2026.8.3 image as a server and a worker with Railway Postgres; current authentik versions no longer need Redis. The admin akadmin is bootstrapped from AUTHENTIK_BOOTSTRAP_EMAIL, a generated password and a generated API token, so the initial-setup flow is locked. Default login flows appear about a minute after the first boot, once the worker applies its blueprints. Uploaded media such as icons live on a Railway volume on the server. Both services together need about 1 GB of RAM, so the Hobby plan works for small setups. Add your own domain to use it for production SSO.

Common Use Cases

Single sign-on for self-hosted apps with OIDC or SAML
Adding login and MFA in front of apps with the proxy outpost
An LDAP directory for legacy apps backed by modern MFA

Dependencies for Authentik Hosting

authentik/server:2026.8.3 (official image, server and worker)
Railway Postgres
A Railway volume at /data on the server

Deployment Dependencies

Implementation Details

Service	Source	Networking	Storage
authentik	`authentik/server:2026.8.3` (`ak server`)	public domain on 9000	volume at `/data`
worker	`authentik/server:2026.8.3` (`ak worker`)	private	none
Postgres	Railway Postgres	private	Railway volume

Variable	Default	Purpose
`AUTHENTIK_BOOTSTRAP_EMAIL`	`admin@example.com`	Email of `akadmin`
`AUTHENTIK_BOOTSTRAP_PASSWORD`	generated	Password of `akadmin`
`AUTHENTIK_BOOTSTRAP_TOKEN`	generated	API token for `akadmin`
`AUTHENTIK_SECRET_KEY`	generated	Signing and encryption key
`AUTHENTIK_URL`	`https://`	Where to sign in

Notes:

Sign in at https:///if/flow/initial-setup/ is disabled; use https:/// with akadmin.
Bootstrap variables only apply on the first start; change the password in the admin UI later.
The worker has no volume, so outposts and certificates are managed through the API rather than files.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by Authentik Security or the authentik project.

Why Deploy Authentik on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Authentik on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.