---
title: "Deploy SpiceDB"
description: "SpiceDB 1.56 Zanzibar-style permissions database with Postgres."
category: "Authentication"
url: https://railway.com/deploy/spicedb-1
---

# Deploy SpiceDB

SpiceDB 1.56 Zanzibar-style permissions database with Postgres.

**[Deploy SpiceDB on Railway](https://railway.com/template/spicedb-1)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/spicedb-1/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication

## Template content

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

### spicedb https://github.com/authzed.png

- **Image:** authzed/spicedb:v1.56.2-debug
- **Start command:** `sh -c 'spicedb datastore migrate head && exec spicedb serve'`
- **Health check:** /healthz
- **Public domain:** Yes

## Documentation

# Deploy and Host SpiceDB on Railway

SpiceDB is an open-source permissions database inspired by Google Zanzibar. You describe your authorization model as a schema of resources, relations and permissions, store relationships, and ask SpiceDB whether a user can do something. Official client libraries for Go, Node.js, Python, Java, Ruby and .NET call it over gRPC or HTTP.

## About Hosting SpiceDB

This template deploys SpiceDB v1.56.2 with a Railway Postgres database as its datastore. On every start the service runs `spicedb datastore migrate head` and then serves. The gRPC API listens on the private network on port 50051. The HTTP API is exposed on the public domain for clients outside Railway. Every request needs the preshared key generated at deploy time, sent as a bearer token. SpiceDB keeps no local state, and Postgres storage grows with the number of relationships, so the Hobby plan is enough to start. SpiceDB's Watch API stays off until Postgres has `track_commit_timestamp` enabled (see below).

## Common Use Cases

- Fine-grained, relationship-based access control (Google Docs-style sharing, teams, folders, orgs)
- Centralizing authorization for several services instead of scattering permission checks in each one
- Pairing with an authentication service (such as SuperTokens) to add authorization

## Dependencies for SpiceDB Hosting

- `authzed/spicedb:v1.56.2-debug` (official image; the `-debug` variant includes a shell for the migrate-then-serve start command)
- Railway Postgres (`ghcr.io/railwayapp-templates/postgres-ssl:18`) with a volume
- A SpiceDB client library or the `zed` CLI

### Deployment Dependencies

- [SpiceDB documentation](https://authzed.com/docs/spicedb/getting-started/discovering-spicedb)
- [SpiceDB v1.56.2 release notes](https://github.com/authzed/spicedb/releases/tag/v1.56.2)
- [SpiceDB client libraries](https://authzed.com/docs/spicedb/getting-started/client-libraries)
- [Railway private networking](https://docs.railway.com/reference/private-networking)

### Implementation Details

| Service | Image | Networking | Storage |
| --- | --- | --- | --- |
| spicedb | `authzed/spicedb:v1.56.2-debug` | public HTTP API on 8443; private gRPC on 50051 | none (all state in Postgres) |
| Postgres | Railway Postgres 18 | private only | volume |

Connect from a service on Railway (gRPC, no TLS on the private network):

```env
SPICEDB_ENDPOINT=${{spicedb.SPICEDB_GRPC_ENDPOINT}}
SPICEDB_TOKEN=${{spicedb.SPICEDB_GRPC_PRESHARED_KEY}}
```

Or over HTTP from anywhere:

```bash
curl -X POST "$SPICEDB_HTTP_URL/v1/permissions/check" \
  -H "Authorization: Bearer $SPICEDB_TOKEN" -H "Content-Type: application/json" \
  -d '{"resource":{"objectType":"document","objectId":"doc1"},"permission":"view","subject":{"object":{"objectType":"user","objectId":"alice"}}}'
```

With `zed`: `zed context set railway   --insecure`.

| Variable | Default | Purpose |
| --- | --- | --- |
| `SPICEDB_GRPC_PRESHARED_KEY` | generated secret | Bearer token required on every request |
| `SPICEDB_DATASTORE_CONN_URI` | `${{Postgres.DATABASE_URL}}` | Postgres datastore |
| `SPICEDB_HTTP_ENABLED` | `true` | Enables the HTTP API on port 8443 |

Notes:

- `/healthz` is unauthenticated and used as the Railway health check.
- To enable the Watch API, run `ALTER SYSTEM SET track_commit_timestamp = on;` on Postgres, then restart Postgres and SpiceDB.
- SpiceDB sends anonymous usage telemetry by default. Add `--telemetry-endpoint=` (empty) to the `spicedb serve` part of the start command to turn it off.
- Back up Postgres; it holds your schema and every relationship.

This is a community-maintained deployment package and does not imply affiliation with or endorsement by AuthZed.

## Why Deploy SpiceDB on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying SpiceDB on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/spicedb-1