---
title: "Deploy OpenFGA"
description: "OpenFGA 1.21 Zanzibar-style authorization server with Postgres."
category: "Authentication"
url: https://railway.com/deploy/openfga-1
---

# Deploy OpenFGA

OpenFGA 1.21 Zanzibar-style authorization server with Postgres.

**[Deploy OpenFGA on Railway](https://railway.com/template/openfga-1)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/openfga-1/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### openfga https://github.com/openfga.png

- **Image:** openfga/openfga:v1.21.0
- **Start command:** `/openfga run`
- **Health check:** /healthz
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

## Documentation

# Deploy and Host OpenFGA on Railway

OpenFGA is a CNCF fine-grained authorization server inspired by Google Zanzibar. You model users, objects and relations in a small DSL, write relationship tuples, and ask OpenFGA whether a user can perform an action. SDKs for Go, Node.js, Python, Java and .NET call its HTTP or gRPC API.

## About Hosting OpenFGA

This template deploys OpenFGA v1.21.0 with a Railway Postgres datastore. Database migrations run automatically as a Railway pre-deploy command before each deployment, so upgrades are one step. Every API request needs the preshared key generated at deploy time, sent as a bearer token. The HTTP API is on the public domain, and HTTP and gRPC also listen on the private network over IPv4 and IPv6. The Playground UI is disabled because it cannot be used with key authentication. OpenFGA is stateless and light, so the Hobby plan is enough. Back up Postgres regularly.

## Common Use Cases

- Relationship-based access control for documents, projects, teams and organizations
- Centralizing permission checks for several services behind one API
- Adding authorization next to an identity provider such as SuperTokens or Keycloak

## Dependencies for OpenFGA Hosting

- `openfga/openfga:v1.21.0` (official image)
- Railway Postgres (`ghcr.io/railwayapp-templates/postgres-ssl:18`) with a volume

### Deployment Dependencies

- [OpenFGA documentation](https://openfga.dev/docs)
- [OpenFGA v1.21.0 release](https://github.com/openfga/openfga/releases/tag/v1.21.0)
- [OpenFGA SDKs](https://openfga.dev/docs/getting-started/install-sdk)
- [Railway private networking](https://docs.railway.com/reference/private-networking)

### Implementation Details

| Service | Image | Networking | Storage |
| --- | --- | --- | --- |
| openfga | `openfga/openfga:v1.21.0` | public HTTP on 8080; private HTTP 8080 and gRPC 8081 | none (state in Postgres) |
| Postgres | Railway Postgres 18 | private only | volume |

```bash
curl -X POST "$OPENFGA_API_URL/stores" -H "Authorization: Bearer $OPENFGA_AUTHN_PRESHARED_KEYS" \
  -H "Content-Type: application/json" -d '{"name": "my-app"}'
```

From another Railway service, use `${{openfga.OPENFGA_PRIVATE_API_URL}}` or gRPC at `${{openfga.OPENFGA_PRIVATE_GRPC}}` with the same key.

| Variable | Default | Purpose |
| --- | --- | --- |
| `OPENFGA_AUTHN_PRESHARED_KEYS` | generated | API key(s), comma-separated for rotation |
| `OPENFGA_DATASTORE_URI` | `${{Postgres.DATABASE_URL}}` | Datastore |
| `OPENFGA_HTTP_ADDR` / `OPENFGA_GRPC_ADDR` | `[::]:8080` / `[::]:8081` | Dual-stack listeners |

Notes:

- The pre-deploy command `/openfga migrate` is part of the template; keep it when editing the service.
- `/healthz` is unauthenticated and used as the Railway health check.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by the OpenFGA project or its maintainers.

## Why Deploy OpenFGA on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying OpenFGA on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/openfga-1