Deploy and Host Authorizer on Railway

Authorizer is an open-source authentication and authorization server: sign-up and login with email and password, a hosted login page, JWT sessions, social login, a GraphQL API and an OpenID Connect discovery document. This template deploys it together with its own Postgres database, with every secret generated for you.

About Hosting Authorizer

The template starts two services: authorizer (the server, public HTTPS domain) and postgres (private, on a persistent volume). Authorizer v2 is configured only through command-line flags, so the start command builds the full flag set from environment variables at boot: public URL, allowed origin, client ID and secret, admin secret, JWT secret, encryption key and the database URL. All of these are generated per deploy as Railway secrets, so nothing has to be filled in before you click Deploy.

After the deploy turns green:

/app is the hosted login and sign-up page.
/dashboard is the admin dashboard. Sign in with the ADMIN_SECRET variable of the authorizer service.
/graphql is the GraphQL API your applications call.
/.well-known/openid-configuration is the OIDC discovery document.
/health is the health endpoint Railway checks.

Multi-factor authentication is switched off with the --disable-mfa flag, because Authorizer v2 enforces MFA setup by default and a plain email and password login would otherwise never return a token. To turn it back on, remove --disable-mfa from the start command of the authorizer service and redeploy.

User accounts live in Postgres on a volume mounted at /var/lib/postgresql, so they survive redeploys and restarts.

Why Deploy Authorizer on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Authorizer on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Login page, admin dashboard and Postgres in one click
Secrets generated automatically, nothing to paste
User data kept on a persistent volume
Public HTTPS domain with the correct redirect URL already configured

Common Use Cases

Replace a hosted identity provider such as Auth0 with a server you own
Add email and password login to a web or mobile app through the GraphQL API
Act as an OpenID Connect provider for internal tools
Prototype sign-up flows before committing to a larger identity stack

Dependencies for Authorizer Hosting

Deployment Dependencies

Implementation Details

The start command is wrapped in /bin/sh -c so environment variables expand, and it passes --url and --allowed-origins from RAILWAY_PUBLIC_DOMAIN. Because Authorizer reads its configuration only from flags, change a setting by editing the start command of the authorizer service. The database connection uses the private network address of the postgres service, with the generated password shared between the two services.