---
title: "Deploy Hasura — Instant GraphQL API for PostgreSQL"
description: "Self-host Hasura — instant GraphQL & REST APIs on Postgres"
category: "Starters"
url: https://railway.com/deploy/hasura-graphql-api
---

# Deploy Hasura — Instant GraphQL API for PostgreSQL

Self-host Hasura — instant GraphQL & REST APIs on Postgres

**[Deploy Hasura — Instant GraphQL API for PostgreSQL on Railway](https://railway.com/template/hasura-graphql-api)**

- **Creator:** SilverBanana
- **Category:** Starters

## Template content

### Hasura https://devicons.railway.app/Hasura?variant=light

- **Image:** hasura/graphql-engine:v2.40.2

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

## Documentation

# Deploy and Host Hasura on Railway

Hasura gives you an instant, production-ready GraphQL API over your PostgreSQL database — connect a database and get a full GraphQL (and REST) API in seconds, with queries, mutations, subscriptions, relationships, and fine-grained authorization, no resolver code to write. This template deploys the open-source Hasura GraphQL Engine with PostgreSQL and a secured admin console, so you can model permissions and ship a real-time API in minutes.

---

## What This Template Deploys

| Service | Purpose |
| --- | --- |
| **Hasura GraphQL Engine** | The instant GraphQL/REST API and admin console on port `8080` |
| **PostgreSQL** | Stores Hasura's metadata and, by default, your application data |

Both connect over Railway's private network. Hasura serves the GraphQL API and its console, using PostgreSQL for its own metadata and — unless you connect an external database — for your application data too. The admin console is protected by an admin secret.

---

## About Hosting

Hasura is powerful and fast to deploy, and a couple of specifics keep it secure and correctly wired — both handled here.

**Two database roles — metadata and your data.** Hasura uses two connection settings: `HASURA_GRAPHQL_METADATA_DATABASE_URL`, where it stores its own configuration (tables tracked, permissions, relationships), and `PG_DATABASE_URL`, the database whose tables it exposes as a GraphQL API. They can point at the same Postgres (as this template does) or be split. This two-URL model is what trips up most first-time deployments — the template wires both correctly.

**The admin secret is mandatory — never run without it.** Without `HASURA_GRAPHQL_ADMIN_SECRET`, your GraphQL console and full admin API are open to anyone who finds the URL, giving them complete control of your data. This template sets a strong admin secret, so the console and admin endpoints require it. Keep it secret and never expose it to client-side code.

**Harden for production.** For a live API, set `HASURA_GRAPHQL_ENABLE_CONSOLE="false"` and `HASURA_GRAPHQL_DEV_MODE="false"` so the console and detailed error traces aren't publicly served, and set `HASURA_GRAPHQL_CORS_DOMAIN` to your frontend's domain to restrict which origins can call the API.

**JWT authentication for real apps.** Set `HASURA_GRAPHQL_JWT_SECRET` to a config pointing at your auth provider's JWKS URL (Auth0, Clerk, Firebase), and Hasura validates tokens on every request and exposes their claims as `x-hasura-*` session variables. You then write row- and column-level permission rules against those variables in Hasura — authorization without a custom backend.

**Bring your own database, or use the included one.** By default this template includes PostgreSQL for both metadata and data. If you already run Postgres on Neon, Supabase, or RDS, remove the bundled database and point both database URLs at your external connection strings — Hasura layers a GraphQL API over your existing schema instantly.

**Real-time subscriptions built in.** Beyond queries and mutations, Hasura serves GraphQL subscriptions over WebSockets, so your frontend gets live updates as data changes — real-time features with no extra infrastructure.

Typical cost: **~$5–10/month** on Railway for the engine and Postgres. The core Hasura GraphQL Engine is Apache-2.0 and free — self-hosting costs only your infrastructure, versus Hasura Cloud's usage-based pricing.

---

## How It Compares

| | Hasura (self-hosted) | Hand-built API | Hasura Cloud | Supabase |
| --- | --- | --- | --- | --- |
| Setup | Instant GraphQL | Weeks of code | Instant | Instant (REST + GraphQL) |
| API | GraphQL + REST | Whatever you build | GraphQL + REST | REST-first |
| Real-time | Subscriptions | Build it | Subscriptions | Realtime |
| Cost model | Flat infra | Dev time | Usage-based | Tiered |
| Data ownership | Full — your infra | Full | Vendor-hosted | Vendor/self |
| Self-hostable | Yes | Yes | No | Yes |

Hand-building an API means weeks of writing and maintaining resolvers, auth, and real-time plumbing. Hasura Cloud is the managed version but bills by usage and runs on their infrastructure. Supabase is a great alternative but REST-first with GraphQL secondary. Hasura's edge is a best-in-class instant GraphQL layer — queries, mutations, subscriptions, and declarative permissions over your Postgres — self-hosted at flat cost, with your data on infrastructure you own.

---

## Deploy in Under 5 Minutes

1. Click **Deploy on Railway** — Hasura and PostgreSQL build and wire together (~3 minutes)
2. Confirm `HASURA_GRAPHQL_ADMIN_SECRET` is set and both database URLs are connected
3. Open your Railway URL at `/console` and enter your admin secret
4. Track a table, and Hasura instantly generates its GraphQL queries, mutations, and subscriptions
5. Point your frontend's GraphQL client at your Railway domain and start querying

Before going live, disable the console and dev mode and set your CORS domain.

---

## Common Use Cases

- **Instant backend for an app** — a full GraphQL API over your database without writing an API layer
- **Real-time features** — live dashboards, chat, and updates via GraphQL subscriptions
- **GraphQL over existing Postgres** — layer an API onto a database you already run
- **Declarative authorization** — role-based, row-level permissions without backend code

---

## Configuration

| Variable | Required | Description |
| --- | --- | --- |
| `HASURA_GRAPHQL_ADMIN_SECRET` | Required | Protects the console and admin API — set a strong value |
| `HASURA_GRAPHQL_METADATA_DATABASE_URL` | Auto-injected | Where Hasura stores its own metadata |
| `PG_DATABASE_URL` | Auto-injected | The database Hasura exposes as a GraphQL API |
| `HASURA_GRAPHQL_JWT_SECRET` | Optional | JWKS config for JWT auth (Auth0, Clerk, Firebase) |
| `HASURA_GRAPHQL_CORS_DOMAIN` | Optional | Restrict API access to your frontend domain |

> **Set the admin secret, and know the two database URLs.** `HASURA_GRAPHQL_ADMIN_SECRET` is mandatory, or the console and admin API are open. Hasura uses a metadata database URL for its own config and `PG_DATABASE_URL` for the data it exposes — both wired here.

> **Harden before production.** Set `HASURA_GRAPHQL_ENABLE_CONSOLE` and `DEV_MODE` to `false` and configure `HASURA_GRAPHQL_CORS_DOMAIN` for a live API, and use `HASURA_GRAPHQL_JWT_SECRET` for app authentication.

---

## Dependencies for Hasura Hosting

- Railway account — ~$5–10/month for the engine and Postgres
- PostgreSQL for metadata and data (included), or an external Postgres (Neon, Supabase, RDS)
- A GraphQL client in your frontend, or any HTTP client for the REST endpoints
- Optional: a JWT auth provider (Auth0, Clerk, Firebase) for authentication

### Deployment Dependencies

- [Hasura GraphQL Engine GitHub](https://github.com/hasura/graphql-engine)
- [Hasura Documentation](https://hasura.io/docs/2.0/index/)
- [Hasura Authorization Guide](https://hasura.io/docs/2.0/auth/authorization/index/)
- [Railway Private Networking](https://docs.railway.com/guides/private-networking)

### Implementation Details

The template runs the open-source `hasura/graphql-engine` image on port `8080` alongside a Railway PostgreSQL service over the private network. Hasura uses two database settings: `HASURA_GRAPHQL_METADATA_DATABASE_URL` for its own metadata and `PG_DATABASE_URL` for the application data it exposes as GraphQL; by default both point at the included Postgres, and either can be repointed at an external database on Neon, Supabase, or RDS.

Security centers on `HASURA_GRAPHQL_ADMIN_SECRET`, which must be set — without it the console and admin GraphQL endpoint are publicly accessible with full data control. For production, `HASURA_GRAPHQL_ENABLE_CONSOLE` and `HASURA_GRAPHQL_DEV_MODE` should be `false` and `HASURA_GRAPHQL_CORS_DOMAIN` set to the frontend origin. Authentication uses `HASURA_GRAPHQL_JWT_SECRET`, a config pointing at an auth provider's JWKS URL; Hasura validates tokens per request and exposes claims as `x-hasura-*` variables used in declarative permission rules. It generates queries, mutations, and real-time subscriptions from your schema automatically, and also exposes REST endpoints. Data and metadata persist in PostgreSQL, the component to back up.

---

## Frequently Asked Questions

**Why are there two database URLs?** Hasura stores its own configuration in a metadata database (`HASURA_GRAPHQL_METADATA_DATABASE_URL`) and exposes a separate data database (`PG_DATABASE_URL`) as GraphQL. They can be the same Postgres or different ones — this template wires both, and understanding the split is the main first-time gotcha.

**Is my API secured?** Only if the admin secret is set — which this template does. Without `HASURA_GRAPHQL_ADMIN_SECRET`, the console and admin API are open to anyone. Keep the secret private and never put it in client code.

**How do I add authentication?** Set `HASURA_GRAPHQL_JWT_SECRET` to a config pointing at your auth provider's JWKS (Auth0, Clerk, Firebase). Hasura validates tokens and exposes claims as `x-hasura-*` variables for permission rules.

**Does it support real-time?** Yes — Hasura serves GraphQL subscriptions over WebSockets, so your app receives live updates as data changes, with no extra infrastructure.

---

## Why Deploy Hasura on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Hasura on Railway you get an instant GraphQL API with the setup handled — PostgreSQL wired for metadata and data, a mandatory admin secret set, and automatic HTTPS. Queries, mutations, real-time subscriptions, and declarative permissions over your database, self-hosted on infrastructure you own.

## Similar templates

- [open-excalidraw](https://railway.com/deploy/open-excalidraw) — Self-hostable collaborative drawing built on Excalidraw
- [caring-vibrancy](https://railway.com/deploy/caring-vibrancy) — Deploy and Host caring-vibrancy with Railway
- [Appsmith](https://railway.com/deploy/appsmith-1) — Low-code platform for internal tools, dashboards, and admin panels.

Open this page in a browser: https://railway.com/deploy/hasura-graphql-api