Deploy and Host Ory Hydra on Railway

Ory Hydra is a certified OAuth 2.0 and OpenID Connect server. It issues access, refresh and ID tokens to your clients and handles the protocol details, while your own app decides who the user is through a small login and consent interface. It is headless and works with any user database.

About Hosting Ory Hydra

This template runs the official oryd/hydra:v26.2.0 image with a Railway Postgres database. A pre-deploy step runs the SQL migrations and retries until the database is reachable. The public endpoints are on an HTTPS domain, and the issuer URL is set to it. The admin API, used to create clients and accept login and consent requests, has no authentication, so it stays on the private network. Machine-to-machine clients work right away with the client credentials grant. For user logins, point URLS_LOGIN, URLS_CONSENT and URLS_LOGOUT at your app; until then, Hydra shows its fallback pages.

Common Use Cases

An OAuth 2.0 authorization server for your public API
OpenID Connect single sign-on for several apps backed by your user database
Machine-to-machine tokens for services with the client credentials grant

Dependencies for Ory Hydra Hosting

oryd/hydra:v26.2.0 (official image)
Railway Postgres for clients, sessions and keys

Deployment Dependencies

Implementation Details

Service	Source	Networking	Storage
hydra	`oryd/hydra:v26.2.0`	public on HTTPS (4444), admin private (4445)	Postgres
Postgres	Railway Postgres	private	volume

Variable	Purpose
`URLS_SELF_ISSUER`	Issuer, set to the public domain
`URLS_LOGIN`, `URLS_CONSENT`, `URLS_LOGOUT`	Your login, consent and logout pages (empty until you add them)
`SECRETS_SYSTEM`	Generated system secret; keep it, it encrypts data in the database
`HYDRA_PUBLIC_URL`, `HYDRA_ADMIN_URL`	Addresses for your apps and backend

Create a client from inside the service (Railway SSH), or from your backend over HYDRA_ADMIN_URL:

hydra create oauth2-client --endpoint http://hydra.railway.internal:4445 \
  --name my-api --grant-type client_credentials --scope read

Discovery is at /.well-known/openid-configuration. If you use a custom domain, update URLS_SELF_ISSUER to match.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by Ory Corp.

Why Deploy Ory Hydra on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Ory Hydra on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.