---
title: "Deploy Casdoor"
description: "Casdoor 4.9 identity provider with OAuth 2.0, OIDC, SAML and a web UI."
category: "Authentication"
url: https://railway.com/deploy/casdoor-2
---

# Deploy Casdoor

Casdoor 4.9 identity provider with OAuth 2.0, OIDC, SAML and a web UI.

**[Deploy Casdoor on Railway](https://railway.com/template/casdoor-2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/casdoor-2/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### casdoor https://github.com/casdoor.png

- **Image:** casbin/casdoor:4.9.0
- **Start command:** `sh -c '/server & pid=$!; trap "kill -TERM $pid" TERM INT; until curl -fs -o /dev/null http://127.0.0.1:8000/api/health; do kill -0 $pid 2>/dev/null || exit 1; sleep 1; done; J=/tmp/casdoor.cookies; if curl -fs -c $J -H "Content-Type: application/json" -X POST http://127.0.0.1:8000/api/login -d "{\"application\":\"app-built-in\",\"organization\":\"built-in\",\"username\":\"admin\",\"password\":\"123\",\"type\":\"login\"}" | grep -qE "\"status\": *\"ok\""; then curl -fs -b $J -X POST http://127.0.0.1:8000/api/set-password --data-urlencode userOwner=built-in --data-urlencode userName=admin --data-urlencode oldPassword=123 --data-urlencode "newPassword=$CASDOOR_ADMIN_PASSWORD" | grep -qE "\"status\": *\"ok\"" && echo "default admin password replaced"; fi; rm -f $J; wait $pid'`
- **Health check:** /api/health
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

## Documentation

# Deploy and Host Casdoor on Railway

Casdoor is an open-source identity and access management platform with a web UI. It acts as an OAuth 2.0, OIDC, SAML, CAS and LDAP provider, supports social logins, MFA, passkeys and user management, and includes Casbin-based permissions. SDKs are available for Go, Java, Node.js, Python, PHP, .NET and frontend frameworks.

## About Hosting Casdoor

This template deploys Casdoor v4.9.0 from the official image with a Railway Postgres database. On first start the well-known default admin password `123` is replaced with a generated one, so the instance is never exposed with it. The OIDC issuer is your Railway domain, and the discovery document works out of the box. Casdoor listens on the public domain and the private network, so backend services can call its API internally. It is light enough for the Hobby plan. Back up Postgres regularly, since it holds your users and applications.

## Common Use Cases

- Single sign-on for internal tools and customer-facing apps
- An OIDC provider for apps that support generic OAuth login
- Central user management with social login and MFA

## Dependencies for Casdoor Hosting

- `casbin/casdoor:4.9.0` (official image)
- Railway Postgres (`ghcr.io/railwayapp-templates/postgres-ssl:18`) with a volume

### Deployment Dependencies

- [Casdoor documentation](https://casdoor.org/docs/overview)
- [Casdoor v4.9.0 release](https://github.com/casdoor/casdoor/releases/tag/v4.9.0)
- [Casdoor SDKs](https://casdoor.org/docs/how-to-connect/sdk)
- [Railway private networking](https://docs.railway.com/reference/private-networking)

### Implementation Details

| Service | Image | Networking | Storage |
| --- | --- | --- | --- |
| casdoor | `casbin/casdoor:4.9.0` | public domain on 8000; private | none (state in Postgres) |
| Postgres | Railway Postgres 18 | private only | volume |

Log in at `https://` as `admin` with `CASDOOR_ADMIN_PASSWORD`, then create an organization and application. OIDC discovery:

```bash
curl https:///.well-known/openid-configuration
```

| Variable | Default | Purpose |
| --- | --- | --- |
| `CASDOOR_ADMIN_PASSWORD` | generated | Replaces the default `123` on first start |
| `origin` | `https://` | Public URL and OIDC issuer |
| `driverName` / `dataSourceName` | Postgres references | Database |

Notes:

- The password is only replaced while `admin/123` still works; change it later in the UI.
- Casdoor reads lowercase variables such as `origin` and `runmode` directly; keep their names.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the Casdoor project or its maintainers.

## Why Deploy Casdoor on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Casdoor on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/casdoor-2