---
title: "Deploy OpenHands | (Just Updated) AI Coding Agent Whose API Key Isn't Public"
description: "Current Agent Canvas 1.14.0. Session key never baked into the page."
category: "AI/ML"
url: https://railway.com/deploy/openhands-or-just-updated-ai-coding-agen
---

# Deploy OpenHands | (Just Updated) AI Coding Agent Whose API Key Isn't Public

Current Agent Canvas 1.14.0. Session key never baked into the page.

**[Deploy OpenHands | (Just Updated) AI Coding Agent Whose API Key Isn't Public on Railway](https://railway.com/template/openhands-or-just-updated-ai-coding-agen)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/openhands-or-just-updated-ai-coding-agen/manifest.json

- **Creator:** SuperSlowSloth
- **Category:** AI/ML

## Template content

### openhands

- **Image:** ghcr.io/bon5co/openhands-railway:1.14.0
- **Health check:** /health
- **Public domain:** Yes

## Documentation

# Deploy and Host OpenHands Agent Canvas on Railway

OpenHands is an open-source AI software-development agent — the self-hosted alternative to
Devin. It writes code, runs commands, edits files and browses the web on your behalf, from a
browser UI. This template deploys **Agent Canvas 1.14.0**, the current OpenHands application
server, as a single Railway service with a persistent volume.

## About Hosting OpenHands Agent Canvas

Agent Canvas ships as one image containing the agent server, the automation server and the
web UI behind a single port. This template runs that image with three Railway-specific
changes:

1. **The session API key is never written into the served page.** Stock Agent Canvas embeds
   its key in the HTML at `/canvas/` so that a browser on the same machine can pick it up
   automatically. On a public URL that hands the key — and therefore arbitrary shell access
   inside the container — to anyone who opens the page. This build starts the server in
   `--auth-required` mode instead, so the UI asks you for the key and the API rejects every
   unauthenticated request.
2. **The volume is made writable before the app starts.** Railway mounts volumes owned by
   uid 0, while the image runs as uid 10001. Without a repair the automation database fails
   to open and the container exits during startup.
3. **Telemetry is off.** `DO_NOT_TRACK=1` is baked into the image.

The image is prebuilt and pinned to 1.14.0, so a deploy is an image pull rather than a
source build, and a later redeploy does not silently upgrade the agent.

## Why Deploy OpenHands Agent Canvas on Railway?

Railway gives the agent a persistent disk for its conversations, workspaces and stored LLM
credentials, a public HTTPS URL, and a one-click redeploy. The session key and the secret
that encrypts stored credentials are both generated per deployment, so nothing sensitive is
shared between installs of this template.

## Common Use Cases

- A hosted coding agent you can reach from any machine, without running Docker locally.
- Long-running refactors, migrations and test-suite fixes that outlive a laptop session.
- Driving the agent over its HTTP API from your own scripts or automations.

## Dependencies for OpenHands Agent Canvas

- An API key for the LLM provider you want the agent to use (OpenAI, Anthropic, or any
  LiteLLM-supported provider). You enter it in the UI after the first sign-in; it is stored
  encrypted with this deployment's own `OH_SECRET_KEY`.

### Deployment Dependencies

- Upstream project: https://github.com/OpenHands/OpenHands
- Upstream image: `ghcr.io/openhands/agent-canvas:1.14.0`
- Railway wrapper image: https://github.com/bon5co/openhands-railway

## First steps

1. Deploy, then open the service URL. You land on the key-entry screen.
2. Copy `OH_SESSION_API_KEYS_0` from the service's Variables tab and paste it in.
3. Add your LLM provider key in Settings, then start a conversation.


## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [stella](https://railway.com/deploy/stella) — Self-host stella with web, API, Postgres, Redis, and object storage.
- [Hermes Agent | OpenClaw Alternative with Dashboard](https://railway.com/deploy/hermes-agent-or-openclaw-alternative-wit) — Self-Hosted Hermes AI Agent for Telegram, Discord & Slack

Open this page in a browser: https://railway.com/deploy/openhands-or-just-updated-ai-coding-agen