Deploy and Host self hosted Penpot API Tokens (Open-Source Design Tool) on Railway

Five services, one public domain, one Penpot instance.

About Hosting Penpot API Tokens open-source software on Railway (self hosted Penpot API and webhooks template)

This template runs Penpot 2.18.3 as five services: a public nginx frontend, the backend holding your files and RPC API, a Chromium exporter, Postgres 18.6 and Valkey 8.1.10. Files and assets sit in your own Railway volumes, not a vendor cloud.

Railway handles generated secrets, private DNS, healthchecks and TLS. Add enable-access-tokens and enable-webhooks to PENPOT_FLAGS, redeploy, then mint tokens under Your account.

Why Deploy Penpot API Tokens, the Figma alternative on Railway (Railway Free Trial)

Figma gives you a REST API and webhooks, but the files, the seats and the billing all live in Figma's cloud. Start with the $5 trial and see if the API covers your workflow.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Penpot API Tokens on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Penpot API Tokens self hosting

Railway ships the five Penpot services with HTTPS and private DNS; a VPS gives you a compose file and leaves TLS, secrets and backups to you.

Provider	What You Get with Railway	What You Get with the Other Provider
DigitalOcean	One deploy with HTTPS and generated secrets.	A Droplet, Docker, compose, a secret key and a reverse proxy for TLS.
AWS	Managed variables and a volume for assets.	ECS or EC2 plus RDS, and S3 once one disk is not enough.
Hetzner	Same stack, about 1.5 GB RAM at idle.	A CX instance with Docker; you own the backups.

Common Use Cases for hosted Penpot API Tokens

Scripted reads of projects and files: call /api/rpc/command/get-profile to confirm the token works, then list teams and projects so a nightly script can snapshot file names and export counts into your own database.
Post a chat message when a file changes: add a team webhook pointing at a small service or a chat relay, and every file update in the team fires a POST with a JSON payload you can drop straight into a channel message.
Sync a file list into a project tracker: poll the RPC API on a schedule and create or close issues in Linear, Jira or a spreadsheet whenever a new file appears in a shared team project.
Read profile and team data for an internal portal: build a lightweight dashboard that shows who is on each team and which projects exist, using a token owned by a service account rather than a person.
Audit comments via webhooks: point a webhook at a request inspector first to see the comment payload shape, then log comment events to your own store for review trails.

Dependencies for Penpot API Tokens Docker hosted on Railway

Access tokens and webhooks are off by default on this template. The RPC API is served by penpot-backend under /api/rpc/command/, and webhooks use outbound HTTPS.

Deployment Dependencies for Managed Penpot API Tokens Service (Design Tools)

penpot-frontend (penpotapp/frontend:2.18.3) is the only public service, on port 8080. penpot-backend (penpotapp/backend:2.18.3) listens privately on 6060, assets on 6070, health-checked at /readyz, and owns the volume at /opt/data/assets.

Implementation Details for Penpot API Tokens (Using Penpot official docker image)

Append enable-access-tokens enable-webhooks to the existing PENPOT_FLAGS value on penpot-backend (space separated, keeping the current flags), save, and redeploy the three Penpot services together. Each token is shown once at creation, so copy it.

How does Penpot API Tokens compare against other design tool APIs

Penpot API vs Figma REST API (Figma Alternative)

Where Penpot wins: tokens, logs and webhook traffic stay on your own instance, and docs ship at /api/_doc. Figma's REST API lives entirely in its cloud.
Tokens and webhooks: both use personal access tokens. Figma reads an X-Figma-Token header; Penpot wants Authorization: Token YOUR-TOKEN and posts JSON or Transit webhooks at team level.
Where Figma wins: breadth. Versioning, Dev Mode handoff and a larger documented API surface go deeper.

Penpot vs Sketch (Sketch Alternative)

Where Penpot wins: Sketch is a macOS-first desktop app; Penpot is browser-based and self hosted, so a token reaches a server you run.
Webhooks: Penpot pushes team events to your endpoint straight from your own server.
Where Sketch wins: offline editing and a mature native app with a large plugin catalog.

Penpot vs Framer (Framer Alternative)

Where Penpot wins: Framer is a hosted design-to-website builder. Penpot keeps files in your Postgres and exposes command-based calls under /api/rpc/command/.
Where Framer wins: publishing. Live sites, animations and hosting come bundled; Penpot handles design and handoff, not deployment.

Penpot vs Lunacy (Lunacy Alternative)

Where Penpot wins: Lunacy is a desktop tool with its own file format; Penpot is MPL-2.0 and self hostable, with a documented token flow and webhooks on one instance.
Where Lunacy wins: built-in assets, icons and AI tooling are generous for a free app, and Windows users get a native editor.

Penpot's API is narrower than Figma's, but it is the only one here you can run, token and all, on your own Railway project.

How to use Penpot API Tokens (the OSS open-source design platform)?

On penpot-backend, add enable-access-tokens enable-webhooks to PENPOT_FLAGS, keeping the existing flags, then redeploy the three Penpot services.
Sign in, open Your account, then Access tokens.
Choose Generate new token, name it, pick an expiry, and copy it once. The token is shown once, so treat it like a password.
Call the RPC API:

curl -H "Authorization: Token YOUR-TOKEN" https://your-domain/api/rpc/command/get-profile

Browse https://your-domain/api/_doc for the other commands.
In team settings, add a webhook pointing at a request inspector, choose JSON or Transit, and trigger an event.

How to self host Penpot API Tokens on other VPS Services (Penpot self hosting guide)

Running Penpot outside Railway means wiring the same five containers by hand. You need Docker, about 2 GB of RAM, and HTTPS in front of nginx.

Clone the Repository

Pull the official compose file from the Penpot repo, not a blog copy.

mkdir penpot
cd penpot
curl -o docker-compose.yaml https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml

Install Dependencies

Install Docker Engine and the Compose plugin.

Configure Environment Variables

Edit the environment blocks in docker-compose.yaml: set PENPOT_PUBLIC_URI=https://your-domain and a random PENPOT_SECRET_KEY, since the sample key is publicly known. Add enable-access-tokens and enable-webhooks to PENPOT_FLAGS for the integration features.

Start the Penpot API Tokens Application

docker compose -p penpot -f docker-compose.yaml up -d

Wait for the backend to go healthy, since first boot runs migrations. Put TLS in front with nginx or Caddy. Railway handles the domain, TLS, database and asset volume for you.

Official Pricing of Penpot API Tokens (Penpot pricing)

Penpot itself is free. It is MPL-2.0 open source, so access tokens, the RPC API and team webhooks cost nothing beyond your infrastructure.

Penpot API Tokens cloud vs self hosted comparison (Pricing, features, costs, and more)

Hosted Penpot cloud and this self-hosted stack run the same app; what changes is who holds the database, tokens and webhook endpoints.

Monthly cost of self hosting Penpot API Tokens on Railway

Self-hosting Penpot is free under MPL-2.0. The JVM backend capped at a 1 GB heap sets the floor, so budget Hobby or above. Railway gives you a $5 trial to test the flags.

System Requirements for Hosting Penpot API Tokens on a VPS

Docker plus docker compose, roughly 2 GB RAM or more, and HTTPS in front via a reverse proxy. You own Postgres backups and the backend assets volume.

Frequently Asked Questions (FAQs)

Why is Access tokens missing in my account?

The enable-access-tokens flag is not in PENPOT_FLAGS on penpot-backend. Add it there, space separated from the existing flags, and redeploy the Penpot services. The menu only appears once the backend boots with that flag.

Where is the API documented?

Penpot generates its own reference at /api/_doc on your instance, so browse to your domain plus that path. Each backend command lives under /api/rpc/command/COMMAND-NAME, and get-profile is the simplest one to test with.

Which events trigger webhooks?

Webhooks sit at team level, and while active Penpot POSTs to your URL for events anywhere in the team.

Should I pick JSON or Transit for the payload?

JSON if the receiving service is a chat bridge or a small script, since every language parses it. Transit is the Clojure-oriented format and worth it only when the consumer already speaks it.

Do access tokens expire?

Yes, if you set an expiry. The generator offers Never, 30, 60, 90 or 180 days, and the token string is shown once at creation, so store it like a password and delete stale ones from the menu beside each token.

Is this the same as the plugins API?

No. Plugins are in-editor JavaScript running inside a design file, and the MCP server is a separate path again. Access tokens call the backend RPC API from outside the editor, so keep the three apart when you plan automation.