Deploy and Host self hosted Cap Google Login (Open-Source Screen Recorder with Google Login) on Railway

This template runs self-hosted Cap with Google sign-in turned on, so your team logs in with Google accounts. You add the Google OAuth keys to cap-web yourself.

About Hosting Cap Google Login open-source software on Railway (self hosted Cap with Google sign-in template)

Cap is an open-source screen recorder, and this template runs the whole stack in your own Railway project: cap-web, media-server, MySQL, and a Railway Bucket for recordings.

Railway takes care of the database volume, the private network, HTTPS on your domain, and the bucket CORS rule that browser uploads need.

Why Deploy Cap Google Login, the Loom alternative on Railway (Railway Free Trial)

If your team already lives in Google accounts, Loom's SSO option sits behind a paid team plan, and you still don't own the video server.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Cap Google Login on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Cap Google Login self hosting

Railway gives you a managed Cap stack with Google sign-in, while a VPS means assembling the same pieces yourself.

Provider	What You Get with Railway	What You Get with the Other Provider
DigitalOcean	Google variables added on cap-web and a redeploy.	A Droplet where you set up Docker and the Google OAuth variables yourself.
AWS	Google sign-in through cap-web variables and CAP_ALLOWED_SIGNUP_DOMAINS.	EC2 and S3 with you handling TLS, the OAuth client and bucket CORS.
Hetzner	A redirect URI that follows your WEB_URL.	A low-cost server where you own every Google setup step.

Most of the Google work is the same wherever you host, so the choice is about how much infrastructure you want to run.

Common Use Cases for hosted Cap Google Login

One-click Google sign-in for a team: Your colleagues open the domain, click Continue with Google, and they're in. Nobody has to wait for a six-digit code to arrive.
Email codes as a fallback: Keep email-code login working alongside Google, so someone without a Google account, or a contractor on a different identity provider, can still get in.
Limiting sign-ups to the company domain: Set CAP_ALLOWED_SIGNUP_DOMAINS on cap-web so random people who find the URL can't create accounts on your server.
Cap Desktop sign-in through the browser: Point Cap Desktop at your server URL and sign in through the browser, so recordings upload to your own bucket under the account you chose.
Moving to a custom domain later: When you attach your own domain, update WEB_URL and add the matching redirect URI in Google Cloud, or Google sign-in will fail on the new address.

Dependencies for Cap Google Login Docker hosted on Railway

Cap Google Login runs as a small stack on Railway, and the Google sign-in piece lives entirely on cap-web. Only that service needs the two Google variables.

Deployment Dependencies for Managed Cap Google Login Service (Screen Recording)

The stack has four parts. cap-web uses the official ghcr.io/capsoftware/cap-web image pinned by digest and serves the dashboard, share pages, auth, and upload API. media-server uses ghcr.io/capsoftware/cap-media-server and listens privately on port 3456.

Google sign-in needs an OAuth client from the Google Cloud console plus GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on cap-web.

Implementation Details for Cap Google Login (Using Cap official docker image)

cap-web exposes port 3000 publicly, with a health check on /api/status. Its volume at /app/apps/web/.workflow-data keeps background job state across redeploys.

Add these variables on cap-web:

GOOGLE_CLIENT_ID=your-client-id
GOOGLE_CLIENT_SECRET=your-secret
CAP_ALLOWED_SIGNUP_DOMAINS=yourcompany.com

CAP_ALLOWED_SIGNUP_DOMAINS locks sign-ups to your company domain, though its exact matching behavior is undocumented, so test it with a second account.

How does Cap Google Login compare against other screen recording tools with team sign-in

Cap Google Login vs Loom SSO (Loom Alternative)

Where Cap wins: Google sign-in uses your own OAuth client, and recordings stay on your Railway bucket.
Domain control: CAP_ALLOWED_SIGNUP_DOMAINS limits sign-ups to your company domain.
Where Loom wins: SSO is a checkbox on a paid team plan, with no Google Cloud project to manage.

Cap Google Login vs Vidyard (Video Hosting Alternative)

Where Cap wins: It is a recorder you host, not a hosted platform built around sales analytics.
Data location: Accounts and recordings sit in your own MySQL and bucket.
Where Vidyard wins: Its viewer analytics go far deeper than anything self-hosted Cap gives you.

Cap Google Login vs Screen Studio (Desktop Recorder Alternative)

Where Cap wins: Teammates open a shared link instead of passing exported files around.
Team sign-in: One Google login covers the whole team, rather than a local license per machine.
Where Screen Studio wins: It needs no server, and its editing tools are far stronger than Cap's.

Cap Google Login vs Tella (Hosted Recording Alternative)

Where Cap wins: You keep recordings on infrastructure you control, with Google sign-in locked to one domain.
Cost model: You pay Railway usage and bucket storage, not per-user plans.
Where Tella wins: It works the moment you sign up, with editing built in and no OAuth setup on your side.

How to use Cap Google Login (the OSS screen recorder)?

Do these on day one, after the deploy is healthy. Email codes keep working until Google sign-in is set up.

In the Google Cloud console, create an OAuth client ID for a web application from the Credentials page. Menu wording may differ, so follow what you see.
Add https://your-domain/api/auth/callback/google as an authorized redirect URI, using the public domain of cap-web. A mismatch here is the most common cause of failed sign-in.
Copy the client ID and secret, then add them to cap-web as variables.
Set CAP_ALLOWED_SIGNUP_DOMAINS on cap-web to your company domain so outsiders can't create accounts.
Redeploy cap-web so the new variables take effect.
Open your domain, choose Google sign-in, and log in with an account from your allowed domain.

GOOGLE_CLIENT_ID=your-client-id
GOOGLE_CLIENT_SECRET=your-client-secret
CAP_ALLOWED_SIGNUP_DOMAINS=yourcompany.com

How to self host Cap Google Login on other VPS Services (Cap self hosting guide)

Outside Railway you run the upstream compose stack yourself, so you own TLS, the bucket and the secrets. This assumes a Linux VPS with Docker and a domain pointed at it.

Clone the Repository

Pull the upstream code, which ships a docker-compose.yml with cap-web, media-server, MySQL and MinIO.

git clone https://github.com/CapSoftware/Cap.git
cd Cap

Install Dependencies

You only need Docker and the Compose plugin on the host.

docker --version
docker compose version

Configure Environment Variables

Set your public URL and replace every default secret, since upstream compose ships publicly known ones.

WEB_URL=https://your-domain
NEXTAUTH_SECRET=generate-a-64-hex-string
DATABASE_ENCRYPTION_KEY=generate-a-64-hex-string
MEDIA_SERVER_WEBHOOK_SECRET=generate-a-64-hex-string

Point the S3 settings at MinIO or any bucket you control.

Start the Cap Google Login Application

Bring the stack up and watch cap-web until migrations finish.

docker compose up -d
docker compose logs -f cap-web

Railway handles TLS, the bucket CORS rule and private networking for you, which you must configure by hand on a VPS.

Official Pricing of Cap Google Login (Cap pricing)

Cap is free and open source under AGPL-3.0, so there is no license fee. Check their pricing pages directly for current numbers.

Cap Google Login cloud vs self hosted comparison (Pricing, features, costs, and more)

Self-hosting Cap means you own the stack, the storage, and the login path.

Monthly cost of self hosting Cap Google Login on Railway

On Railway, expect roughly $10-20 per month for a small team, based on about 850 MB of idle RAM across cap-web, MySQL, and media-server.

System Requirements for Hosting Cap Google Login on a VPS

On a VPS, plan for about 850 MB of RAM at idle, with the media server growing during long recordings.

Frequently Asked Questions (FAQs)

Why does Google sign-in fail with a redirect URI mismatch error?

The redirect URI registered in your Google Cloud OAuth client has to match your public domain exactly, including https and the path /api/auth/callback/google.

Should I set the Google consent screen to Internal or External?

Use Internal if everyone signing in belongs to one Google Workspace organization, since that skips verification.

Does email code login still work once Google sign-in is enabled?

Yes.

What happens to Google sign-in when I add a custom domain?

Set WEB_URL to the new domain, redeploy, and register the new redirect URI in Google Cloud.

How do I restrict Google sign-ups to my company's domain?

Set CAP_ALLOWED_SIGNUP_DOMAINS on cap-web to your domain, then redeploy. Confirm the matching behavior with a test account from another domain before you rely on it.

Can I sign in to Cap Desktop with Google?

Desktop sign-in goes through your server URL in the browser, so set Cap Server URL to your domain in Cap Desktop settings and complete the Google sign-in in the browser window that opens.