Deploy and Host LibreChat on Railway

LibreChat is the leading open-source, multi-provider AI chat platform — a self-hosted ChatGPT-style interface that connects OpenAI, Anthropic, Google, and dozens of other providers in one place. Switch between GPT, Claude, and Gemini mid-conversation, run RAG over your own documents, search your full chat history, and give a whole team access without sharing raw API keys. This template deploys the full stack: LibreChat, MongoDB, Meilisearch, PGVector, and the RAG API.

What This Template Deploys

All services run on Railway's private network. MongoDB, PGVector, and Meilisearch are never publicly exposed, and secrets are generated at deploy time.

About Hosting LibreChat

LibreChat is a five-service application, and two configuration details cause most failed deployments — both worth getting right before anything else.

CREDS_KEY and CREDS_IV are exact lengths, not just "random strings." LibreChat encrypts every stored provider API key with them, and the encryption is length-specific: CREDS_KEY must be 32 bytes (openssl rand -hex 32) and CREDS_IV must be 16 bytes (openssl rand -hex 16). Get the IV length wrong and LibreChat cannot decrypt saved keys — every provider connection breaks with an opaque error. This template generates both at the correct lengths.

MEILI_MASTER_KEY must match across two services. The LibreChat service and the Meilisearch service must share the exact same master key, and Meilisearch refuses to start if it is under 16 bytes. A mismatch means search silently fails while everything else works. This template wires the same key to both.

The RAG API and PGVector add real memory overhead. Budget 2 GB RAM minimum for the full stack; a lighter deployment can drop RAG if document Q&A isn't needed.

Typical cost: ~$10–20/month on Railway for all five services, plus your model providers' usage. Connect cloud LLMs and no GPU is needed.

How It Compares

ChatGPT Team is simpler but OpenAI-only and per-seat. Open WebUI leans toward local Ollama models. LibreChat is strongest for cloud providers, multi-user teams, and enterprise auth — many providers behind one login, on infrastructure you own.

Deploy in Under 5 Minutes

1. Click Deploy on Railway — all five services build automatically (~4 minutes)
2. Confirm CREDS_KEY (32-byte) and CREDS_IV (16-byte) are set, and that MEILI_MASTER_KEY matches on both LibreChat and Meilisearch
3. Set DOMAIN_CLIENT and DOMAIN_SERVER to your Railway public domain
4. Add a provider key (OPENAI_API_KEY, ANTHROPIC_API_KEY, GOOGLE_KEY) or leave as user_provided to let users bring their own
5. Open your domain, register the first account, and start chatting

The first registered account becomes the admin. Disable ALLOW_REGISTRATION afterward to close public signup.

Common Use Cases

• Team AI hub — give engineering or research teams a private ChatGPT-style interface with shared access to GPT, Claude, and Gemini without handing out raw API keys
• Document Q&A — upload PDFs and query them through the RAG pipeline with any connected model
• Model comparison — benchmark responses across OpenAI, Anthropic, and Google side by side in one interface
• Privacy-first AI — run conversations on infrastructure you control, with nothing sent to third-party chat services
• Multi-provider fallback — switch providers mid-conversation when one is rate-limited or a different model fits the task
• Enterprise-auth deployments — OAuth2 and LDAP login for organisations that need managed access

Configuration

CREDS_IV must be exactly 16 bytes. LibreChat's credential encryption is length-specific. A wrong-length IV means stored provider keys can't be decrypted — an opaque failure. Generate it with openssl rand -hex 16.

MEILI_MASTER_KEY must match across both services. LibreChat and Meilisearch must share the same key, and it must be at least 16 bytes or Meilisearch won't start. A mismatch makes search silently fail.

Dependencies for LibreChat Hosting

• Railway account — expect ~$10–20/month across the five services
• At least one model provider API key, or let users provide their own
• 2 GB RAM minimum for the full RAG-enabled stack
• Optional: OAuth2 or LDAP provider for enterprise authentication

Deployment Dependencies

• LibreChat GitHub Repository
• LibreChat Documentation
• LibreChat Railway Guide
• Railway Variables Documentation

Implementation Details

The template runs ghcr.io/danny-avila/librechat-dev on port 3080 alongside MongoDB, Meilisearch, a PGVector-enabled PostgreSQL, and the LibreChat RAG API — the same five-service topology as LibreChat's own Docker Compose. All backing services communicate over Railway's private network and are never publicly exposed.

CREDS_KEY and CREDS_IV are generated at their required lengths (32 and 16 bytes) because LibreChat's credential encryption fails silently if they're wrong, and MEILI_MASTER_KEY is wired identically to both LibreChat and Meilisearch so full-text search initialises correctly. MEILI_HOST and RAG_API_URL resolve through Railway reference variables to the private service addresses.

Chat history and users live in MongoDB; document embeddings live in PGVector via the RAG API. Both hold your data and should be backed up. Provider keys can be set as user_provided, so each user supplies their own key rather than sharing one — useful for teams that want per-user billing and access.

Frequently Asked Questions

Why does CREDS_IV have to be a specific length? LibreChat encrypts stored provider keys with AES, which requires a 16-byte IV. A wrong-length value breaks decryption of every saved key with an unclear error. Generate it with openssl rand -hex 16; the template does this for you.

Search isn't working — why? Almost always a MEILI_MASTER_KEY mismatch between the LibreChat and Meilisearch services, or a key under 16 bytes. Both services must share the exact same key. Everything else can work while search silently fails.

Which providers are supported? OpenAI, Anthropic, Google, and many others including OpenRouter, Azure, and local endpoints. Switch between them mid-conversation from the model selector.

Can each user bring their own API key? Yes. Set the provider variables to user_provided and each user enters their own key, which is encrypted per-user in MongoDB. Useful for per-user billing.

Do I need a GPU? No, not for cloud models. LibreChat orchestrates requests to your providers, so it runs on CPU. A GPU only matters for local inference on a separate host.

How much RAM does it need? 2 GB minimum for the full stack, because the RAG API and PGVector add overhead. Drop the RAG services if you don't need document Q&A and it runs lighter.

How do I make it multi-user? Registration is on by default — the first account is admin. Add users via signup, or configure OAuth2/LDAP for managed access, then set ALLOW_REGISTRATION=false to close public signup.

Why Deploy LibreChat on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying LibreChat on Railway you get a full multi-provider AI workspace with the tricky parts already solved — five services pre-wired over a private network, credential keys generated at the right lengths, Meilisearch keyed correctly, RAG ready, and automatic HTTPS. Many providers behind one login, your conversations and documents on infrastructure you own.