Deploy and Host SpiceDB on Railway

SpiceDB is an open-source permissions database inspired by Google Zanzibar. You describe your authorization model as a schema of resources, relations and permissions, store relationships, and ask SpiceDB whether a user can do something. Official client libraries for Go, Node.js, Python, Java, Ruby and .NET call it over gRPC or HTTP.

About Hosting SpiceDB

This template deploys SpiceDB v1.56.2 with a Railway Postgres database as its datastore. On every start the service runs spicedb datastore migrate head and then serves. The gRPC API listens on the private network on port 50051. The HTTP API is exposed on the public domain for clients outside Railway. Every request needs the preshared key generated at deploy time, sent as a bearer token. SpiceDB keeps no local state, and Postgres storage grows with the number of relationships, so the Hobby plan is enough to start. SpiceDB's Watch API stays off until Postgres has track_commit_timestamp enabled (see below).

Common Use Cases

Fine-grained, relationship-based access control (Google Docs-style sharing, teams, folders, orgs)
Centralizing authorization for several services instead of scattering permission checks in each one
Pairing with an authentication service (such as SuperTokens) to add authorization

Dependencies for SpiceDB Hosting

authzed/spicedb:v1.56.2-debug (official image; the -debug variant includes a shell for the migrate-then-serve start command)
Railway Postgres (ghcr.io/railwayapp-templates/postgres-ssl:18) with a volume
A SpiceDB client library or the zed CLI

Deployment Dependencies

Implementation Details

Service	Image	Networking	Storage
spicedb	`authzed/spicedb:v1.56.2-debug`	public HTTP API on 8443; private gRPC on 50051	none (all state in Postgres)
Postgres	Railway Postgres 18	private only	volume

Connect from a service on Railway (gRPC, no TLS on the private network):

SPICEDB_ENDPOINT=${{spicedb.SPICEDB_GRPC_ENDPOINT}}
SPICEDB_TOKEN=${{spicedb.SPICEDB_GRPC_PRESHARED_KEY}}

Or over HTTP from anywhere:

curl -X POST "$SPICEDB_HTTP_URL/v1/permissions/check" \
  -H "Authorization: Bearer $SPICEDB_TOKEN" -H "Content-Type: application/json" \
  -d '{"resource":{"objectType":"document","objectId":"doc1"},"permission":"view","subject":{"object":{"objectType":"user","objectId":"alice"}}}'

With zed: zed context set railway --insecure.

Variable	Default	Purpose
`SPICEDB_GRPC_PRESHARED_KEY`	generated secret	Bearer token required on every request
`SPICEDB_DATASTORE_CONN_URI`	`${{Postgres.DATABASE_URL}}`	Postgres datastore
`SPICEDB_HTTP_ENABLED`	`true`	Enables the HTTP API on port 8443

Notes:

/healthz is unauthenticated and used as the Railway health check.
To enable the Watch API, run ALTER SYSTEM SET track_commit_timestamp = on; on Postgres, then restart Postgres and SpiceDB.
SpiceDB sends anonymous usage telemetry by default. Add --telemetry-endpoint= (empty) to the spicedb serve part of the start command to turn it off.
Back up Postgres; it holds your schema and every relationship.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by AuthZed.

Why Deploy SpiceDB on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying SpiceDB on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.