Deploy and Host Kong Gateway on Railway

Kong Gateway is an open-source API gateway built on NGINX and OpenResty. It sits in front of your services and routes traffic to them, and it adds authentication, rate limiting, request transformation, caching and logging through plugins. You configure it through its Admin API, the Kong Manager web UI or declarative files with decK.

About Hosting Kong Gateway

Kong needs a Postgres database for its configuration, schema migrations before it starts, and a public port for the proxy. The Admin API can change every route and plugin, so it must never be open to the internet. This template runs the official open-source image (Kong 3.9.4) with Railway Postgres. On every start it runs the migrations and serves the proxy on your Railway domain. The Admin API and Kong Manager listen only inside the container. They are reachable through the proxy at /kong-admin and /kong-manager, over HTTPS only, behind a login with a password generated at deploy.

Common Use Cases

Put one gateway in front of several APIs or microservices, with routing by path or host
Add API keys, basic auth, JWT, rate limiting or CORS to an API without changing its code
Centralise request logging, header changes and upstream load balancing

Dependencies for Kong Gateway Hosting

Railway Postgres (included) for Kong's configuration
Nothing else to bring: the admin password is generated at deploy

Deployment Dependencies

Implementation Details

After the deploy, copy KONG_ADMIN_PASSWORD from the Kong service's Variables tab. The user name is admin.

Kong Manager: open https://YOUR-APP.up.railway.app/kong-manager/ and log in.
Admin API: https://YOUR-APP.up.railway.app/kong-admin/ with HTTP basic auth.

Create a service and a route, then call it through the proxy:

KONG=https://YOUR-APP.up.railway.app
curl -u "admin:$KONG_ADMIN_PASSWORD" $KONG/kong-admin/services \
  -d name=example -d url=https://httpbin.org/anything
curl -u "admin:$KONG_ADMIN_PASSWORD" $KONG/kong-admin/services/example/routes \
  -d name=example -d 'paths[]=/example'
curl $KONG/example/hello

With decK: deck gateway ping --kong-addr $KONG/kong-admin --headers "Authorization: Basic $(printf 'admin:%s' "$KONG_ADMIN_PASSWORD" | base64)".

The admin routes are Kong entities tagged kong-railway (services kong-admin-api, kong-manager and kong-health, and the consumer kong-admin). The start command re-applies them on every deploy, so a change to them is undone at the next restart. Only the kong-admin consumer can use them: other consumers you create get 403. To change the password, set a new KONG_ADMIN_PASSWORD and redeploy. The paths /kong-admin, /kong-manager and /kong_health are reserved, so don't use them for your own routes. If you add a custom domain, also set KONG_ADMIN_GUI_API_URL to https://your-domain/kong-manager/api so Kong Manager calls the right host. Kong sees Railway's TLS termination through X-Forwarded-Proto, so routes limited to https work.

Why Deploy Kong Gateway on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Kong Gateway on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.