Deploy and Host OpenFGA on Railway

OpenFGA is a CNCF fine-grained authorization server inspired by Google Zanzibar. You model users, objects and relations in a small DSL, write relationship tuples, and ask OpenFGA whether a user can perform an action. SDKs for Go, Node.js, Python, Java and .NET call its HTTP or gRPC API.

About Hosting OpenFGA

This template deploys OpenFGA v1.21.0 with a Railway Postgres datastore. Database migrations run automatically as a Railway pre-deploy command before each deployment, so upgrades are one step. Every API request needs the preshared key generated at deploy time, sent as a bearer token. The HTTP API is on the public domain, and HTTP and gRPC also listen on the private network over IPv4 and IPv6. The Playground UI is disabled because it cannot be used with key authentication. OpenFGA is stateless and light, so the Hobby plan is enough. Back up Postgres regularly.

Common Use Cases

Relationship-based access control for documents, projects, teams and organizations
Centralizing permission checks for several services behind one API
Adding authorization next to an identity provider such as SuperTokens or Keycloak

Dependencies for OpenFGA Hosting

openfga/openfga:v1.21.0 (official image)
Railway Postgres (ghcr.io/railwayapp-templates/postgres-ssl:18) with a volume

Deployment Dependencies

Implementation Details

Service	Image	Networking	Storage
openfga	`openfga/openfga:v1.21.0`	public HTTP on 8080; private HTTP 8080 and gRPC 8081	none (state in Postgres)
Postgres	Railway Postgres 18	private only	volume

curl -X POST "$OPENFGA_API_URL/stores" -H "Authorization: Bearer $OPENFGA_AUTHN_PRESHARED_KEYS" \
  -H "Content-Type: application/json" -d '{"name": "my-app"}'

From another Railway service, use ${{openfga.OPENFGA_PRIVATE_API_URL}} or gRPC at ${{openfga.OPENFGA_PRIVATE_GRPC}} with the same key.

Variable	Default	Purpose
`OPENFGA_AUTHN_PRESHARED_KEYS`	generated	API key(s), comma-separated for rotation
`OPENFGA_DATASTORE_URI`	`${{Postgres.DATABASE_URL}}`	Datastore
`OPENFGA_HTTP_ADDR` / `OPENFGA_GRPC_ADDR`	`[::]:8080` / `[::]:8081`	Dual-stack listeners

Notes:

The pre-deploy command /openfga migrate is part of the template; keep it when editing the service.
/healthz is unauthenticated and used as the Railway health check.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the OpenFGA project or its maintainers.

Why Deploy OpenFGA on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenFGA on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.