Deploy Permify Latest

Deploy and Host Permify on Railway

About Hosting Permify

Permify is an open-source authorization service for building and managing fine-grained access controls. Inspired by Google Zanzibar, it supports RBAC, ReBAC, and ABAC patterns, allowing applications to perform scalable permission checks and model complex authorization relationships.

Railway hosts Permify as a stateless service alongside PostgreSQL for persistent authorization data. The services communicate over Railway's private network, while Permify can expose gRPC on port 3478 and REST on port 3476. Railway simplifies deployment, networking, HTTPS, and scaling without requiring manual infrastructure configuration. PostgreSQL stores authorization schemas, relationship tuples, and permission data, while Permify instances can scale horizontally as application traffic grows.

Common Use Cases

• Fine-Grained Access Control: Determine whether a user can access or modify a specific resource with low-latency permission checks.
• Multi-Tenant Authorization: Build isolated authorization models for organizations or tenants in SaaS applications.
• Role-Based Access Control (RBAC): Implement hierarchical roles such as Admin, Manager, and Member with inherited permissions.
• Relationship-Based Access Control (ReBAC): Model permissions based on relationships between users and resources, such as folder and file sharing.

Dependencies for Permify Hosting

• PostgreSQL Database — Required for storing authorization schemas, relationship tuples, and permission data. The database is included in this template and communicates with Permify over Railway's private network.

Deployment Dependencies

• Permify Documentation
• Permify GitHub Repository
• Permify Playground
• Permify API Reference
• Google Zanzibar Explained

Implementation Details

Docker

The provided deployment documentation does not specify a Docker image or Dockerfile. No custom Docker image is therefore documented for this template.

If the repository includes a Dockerfile, Railway automatically detects and builds it during deployment.

Public Networking

Permify exposes two application interfaces:

Applications connecting through Railway's private network can use the Permify private domain rather than a public endpoint.

Environment Variables

The application consuming Permify should configure the following variables:

Use Railway's Raw Editor to configure the variables:

PERMIFY_HOST=${{Permify.RAILWAY_PRIVATE_DOMAIN}}
PERMIFY_GRPC_PORT=3478
PERMIFY_API_KEY=${{Permify.PERMIFY_AUTHN_PRESHARED_KEYS}}

API authentication is enabled for this deployment. The configured pre-shared key should be used by applications when authenticating with Permify.

Persistent Storage

Persistent storage is provided by the PostgreSQL dependency rather than a documented Railway Volume. PostgreSQL stores Permify authorization schemas, relationship tuples, and permission data.

No separate Railway Volume mount path is documented for Permify.

Database

PostgreSQL is required by this deployment.

Add the PostgreSQL service alongside the Permify service in the Railway project. Permify communicates with PostgreSQL through Railway's private network.

The PostgreSQL connection configuration is part of the deployment setup. The provided documentation does not specify individual PostgreSQL environment variable names, so no additional variables are listed here.

Build & Start

No custom build or start commands are documented in the provided deployment configuration.

If the repository contains a Dockerfile, Railway automatically builds the service from it.

Accessing the Application

After deployment, configure the required networking for the Permify service:

1. Open the Permify service in Railway.
2. Go to Settings → Networking.
3. Generate a Railway Domain if public REST access is required.
4. Use the generated domain to access the REST API on port 3476.
5. Applications using Railway's private network can connect through PERMIFY_HOST and gRPC port 3478.
6. The /healthz endpoint on port 3476 can be used to verify service health.

API authentication is enabled, so clients should provide the configured Permify API key when making authenticated requests.

Why Deploy Permify on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Permify on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.