Deploy and Host Authentik on Railway

Built for an LLM agent to deploy and use. There is no setup wizard and nothing to fill in: the admin password and an API token are generated at deploy time, the contract below lists every URL and variable name, and one working script authenticates against the REST API and creates a group.

Authentik is an open-source identity provider and SSO platform: OpenID Connect, OAuth2, SAML, LDAP and proxy providers, flexible login flows, MFA, and user and group management. This template runs the official Authentik server image together with a PostgreSQL database, and keeps both on Railway volumes so users, applications and flows survive redeploys.

About Hosting Authentik

This template runs two services. authentik is the official ghcr.io/goauthentik/server image (pinned by digest) started as ak allinone, which runs the web server and the background worker in one container, with a volume at /data. postgres is the official postgres:17 image (pinned by digest) with a volume at /var/lib/postgresql, reachable only on the private network. On first boot Authentik runs its database migrations, which take a few minutes, then creates the akadmin user from AUTHENTIK_BOOTSTRAP_PASSWORD and AUTHENTIK_BOOTSTRAP_EMAIL and registers AUTHENTIK_BOOTSTRAP_TOKEN as an API token for it. Update checks and startup analytics are disabled.

The server listens on [::]:$PORT, so Railway's healthcheck and the private network (IPv6) both reach it. The container runs as root only so it can fix ownership of the root-owned Railway volume; Authentik then drops privileges itself. Allow roughly 150 seconds for the first deploy to turn healthy.

Agent contract

Public URL: https://, on the authentik service (set AUTHENTIK_URL to it, no trailing slash)
Private URL: http://authentik.railway.internal:8080
Credentials: user akadmin, password in AUTHENTIK_BOOTSTRAP_PASSWORD, API token in AUTHENTIK_BOOTSTRAP_TOKEN (both on the authentik service)
Auth: Authorization: Bearer $AUTHENTIK_BOOTSTRAP_TOKEN on every /api/v3/ call; anonymous requests get 403; the web interface is at /if/admin/ and takes the akadmin password
Health: GET /api/v3/ returns 200 with no credentials

# run with AUTHENTIK_URL and AUTHENTIK_BOOTSTRAP_TOKEN (authentik service); needs curl
H="Authorization: Bearer $AUTHENTIK_BOOTSTRAP_TOKEN"
curl -s -o /dev/null -w 'health %{http_code}\n' "$AUTHENTIK_URL/api/v3/"
curl -s -o /dev/null -w 'anonymous %{http_code}\n' "$AUTHENTIK_URL/api/v3/core/users/me/"
curl -fsS -H "$H" "$AUTHENTIK_URL/api/v3/core/users/me/" | grep -o '"username":"[a-z]*"'
curl -fsS -H "$H" -H 'Content-Type: application/json' -d '{"name":"agents"}' "$AUTHENTIK_URL/api/v3/core/groups/" -o /dev/null -w 'create group %{http_code}\n'
curl -fsS -H "$H" "$AUTHENTIK_URL/api/v3/core/groups/?name=agents" | grep -o '"name":"agents"'

A fresh deploy prints health 200, anonymous 403, "username":"akadmin", create group 201 and "name":"agents". Create applications, providers and users the same way under /api/v3/, or open /if/admin/ and sign in as akadmin.

Why Deploy Authentik on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Authentik on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - generated admin password and API token, a contract block and one working script; no setup wizard.
Stable login - the admin password, API token and secret key are the same after every redeploy.
State survives redeploys - the database and the Authentik data directory live on volumes.
Private database - PostgreSQL has no public domain and is reached over the private network.

Common Use Cases

Single sign-on for self-hosted apps - one login for Grafana, Gitea, Nextcloud and anything that speaks OIDC or SAML.
Agent-driven identity management - let an AI agent create users, groups, applications and providers through the REST API.
Authentication for your own product - an OIDC provider with MFA and custom login flows in front of an internal tool.

Dependencies for Authentik Hosting

A PostgreSQL database (included in this template, volume at /var/lib/postgresql).
A volume at /data on the Authentik service (included in this template).

Deployment Dependencies

goauthentik/authentik - upstream project
Authentik documentation - configuration reference