Deploy Hasura — Instant GraphQL API for PostgreSQL

Deploy and Host Hasura on Railway

Hasura gives you an instant, production-ready GraphQL API over your PostgreSQL database — connect a database and get a full GraphQL (and REST) API in seconds, with queries, mutations, subscriptions, relationships, and fine-grained authorization, no resolver code to write. This template deploys the open-source Hasura GraphQL Engine with PostgreSQL and a secured admin console, so you can model permissions and ship a real-time API in minutes.

What This Template Deploys

Both connect over Railway's private network. Hasura serves the GraphQL API and its console, using PostgreSQL for its own metadata and — unless you connect an external database — for your application data too. The admin console is protected by an admin secret.

About Hosting

Hasura is powerful and fast to deploy, and a couple of specifics keep it secure and correctly wired — both handled here.

Two database roles — metadata and your data. Hasura uses two connection settings: HASURA_GRAPHQL_METADATA_DATABASE_URL, where it stores its own configuration (tables tracked, permissions, relationships), and PG_DATABASE_URL, the database whose tables it exposes as a GraphQL API. They can point at the same Postgres (as this template does) or be split. This two-URL model is what trips up most first-time deployments — the template wires both correctly.

The admin secret is mandatory — never run without it. Without HASURA_GRAPHQL_ADMIN_SECRET, your GraphQL console and full admin API are open to anyone who finds the URL, giving them complete control of your data. This template sets a strong admin secret, so the console and admin endpoints require it. Keep it secret and never expose it to client-side code.

Harden for production. For a live API, set HASURA_GRAPHQL_ENABLE_CONSOLE="false" and HASURA_GRAPHQL_DEV_MODE="false" so the console and detailed error traces aren't publicly served, and set HASURA_GRAPHQL_CORS_DOMAIN to your frontend's domain to restrict which origins can call the API.

JWT authentication for real apps. Set HASURA_GRAPHQL_JWT_SECRET to a config pointing at your auth provider's JWKS URL (Auth0, Clerk, Firebase), and Hasura validates tokens on every request and exposes their claims as x-hasura-* session variables. You then write row- and column-level permission rules against those variables in Hasura — authorization without a custom backend.

Bring your own database, or use the included one. By default this template includes PostgreSQL for both metadata and data. If you already run Postgres on Neon, Supabase, or RDS, remove the bundled database and point both database URLs at your external connection strings — Hasura layers a GraphQL API over your existing schema instantly.

Real-time subscriptions built in. Beyond queries and mutations, Hasura serves GraphQL subscriptions over WebSockets, so your frontend gets live updates as data changes — real-time features with no extra infrastructure.

Typical cost: ~$5–10/month on Railway for the engine and Postgres. The core Hasura GraphQL Engine is Apache-2.0 and free — self-hosting costs only your infrastructure, versus Hasura Cloud's usage-based pricing.

How It Compares

Hand-building an API means weeks of writing and maintaining resolvers, auth, and real-time plumbing. Hasura Cloud is the managed version but bills by usage and runs on their infrastructure. Supabase is a great alternative but REST-first with GraphQL secondary. Hasura's edge is a best-in-class instant GraphQL layer — queries, mutations, subscriptions, and declarative permissions over your Postgres — self-hosted at flat cost, with your data on infrastructure you own.

Deploy in Under 5 Minutes

1. Click Deploy on Railway — Hasura and PostgreSQL build and wire together (~3 minutes)
2. Confirm HASURA_GRAPHQL_ADMIN_SECRET is set and both database URLs are connected
3. Open your Railway URL at /console and enter your admin secret
4. Track a table, and Hasura instantly generates its GraphQL queries, mutations, and subscriptions
5. Point your frontend's GraphQL client at your Railway domain and start querying

Before going live, disable the console and dev mode and set your CORS domain.

Common Use Cases

• Instant backend for an app — a full GraphQL API over your database without writing an API layer
• Real-time features — live dashboards, chat, and updates via GraphQL subscriptions
• GraphQL over existing Postgres — layer an API onto a database you already run
• Declarative authorization — role-based, row-level permissions without backend code

Configuration

Set the admin secret, and know the two database URLs. HASURA_GRAPHQL_ADMIN_SECRET is mandatory, or the console and admin API are open. Hasura uses a metadata database URL for its own config and PG_DATABASE_URL for the data it exposes — both wired here.

Harden before production. Set HASURA_GRAPHQL_ENABLE_CONSOLE and DEV_MODE to false and configure HASURA_GRAPHQL_CORS_DOMAIN for a live API, and use HASURA_GRAPHQL_JWT_SECRET for app authentication.

Dependencies for Hasura Hosting

• Railway account — ~$5–10/month for the engine and Postgres
• PostgreSQL for metadata and data (included), or an external Postgres (Neon, Supabase, RDS)
• A GraphQL client in your frontend, or any HTTP client for the REST endpoints
• Optional: a JWT auth provider (Auth0, Clerk, Firebase) for authentication

Deployment Dependencies

• Hasura GraphQL Engine GitHub
• Hasura Documentation
• Hasura Authorization Guide
• Railway Private Networking

Implementation Details

The template runs the open-source hasura/graphql-engine image on port 8080 alongside a Railway PostgreSQL service over the private network. Hasura uses two database settings: HASURA_GRAPHQL_METADATA_DATABASE_URL for its own metadata and PG_DATABASE_URL for the application data it exposes as GraphQL; by default both point at the included Postgres, and either can be repointed at an external database on Neon, Supabase, or RDS.

Security centers on HASURA_GRAPHQL_ADMIN_SECRET, which must be set — without it the console and admin GraphQL endpoint are publicly accessible with full data control. For production, HASURA_GRAPHQL_ENABLE_CONSOLE and HASURA_GRAPHQL_DEV_MODE should be false and HASURA_GRAPHQL_CORS_DOMAIN set to the frontend origin. Authentication uses HASURA_GRAPHQL_JWT_SECRET, a config pointing at an auth provider's JWKS URL; Hasura validates tokens per request and exposes claims as x-hasura-* variables used in declarative permission rules. It generates queries, mutations, and real-time subscriptions from your schema automatically, and also exposes REST endpoints. Data and metadata persist in PostgreSQL, the component to back up.

Frequently Asked Questions

Why are there two database URLs? Hasura stores its own configuration in a metadata database (HASURA_GRAPHQL_METADATA_DATABASE_URL) and exposes a separate data database (PG_DATABASE_URL) as GraphQL. They can be the same Postgres or different ones — this template wires both, and understanding the split is the main first-time gotcha.

Is my API secured? Only if the admin secret is set — which this template does. Without HASURA_GRAPHQL_ADMIN_SECRET, the console and admin API are open to anyone. Keep the secret private and never put it in client code.

How do I add authentication? Set HASURA_GRAPHQL_JWT_SECRET to a config pointing at your auth provider's JWKS (Auth0, Clerk, Firebase). Hasura validates tokens and exposes claims as x-hasura-* variables for permission rules.

Does it support real-time? Yes — Hasura serves GraphQL subscriptions over WebSockets, so your app receives live updates as data changes, with no extra infrastructure.

Why Deploy Hasura on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Hasura on Railway you get an instant GraphQL API with the setup handled — PostgreSQL wired for metadata and data, a mandatory admin secret set, and automatic HTTPS. Queries, mutations, real-time subscriptions, and declarative permissions over your database, self-hosted on infrastructure you own.