---
title: "Deploy SpiceDB relationship authorization"
description: "Durable relationship-based authorization with PostgreSQL."
category: "Authentication"
url: https://railway.com/deploy/spicedb-relationship-authorization
---

# Deploy SpiceDB relationship authorization

Durable relationship-based authorization with PostgreSQL.

**[Deploy SpiceDB relationship authorization on Railway](https://railway.com/template/spicedb-relationship-authorization)**

- **Creator:** Anton Orel's Projects
- **Category:** Authentication
- **Total deploys:** 2

## Template content

### SpiceDB Gateway

- **Image:** caddy:2.11.4-alpine@sha256:5f5c8640aae01df9654968d946d8f1a56c497f1dd5c5cda4cf95ab7c14d58648
- **Start command:** `/bin/sh -ec 'printf "%s\n" "$GATEWAY_CONFIG" | sed -e "s|__UPSTREAM__|$UPSTREAM|g" -e "s|__SPICEDB_KEY__|$SPICEDB_KEY|g" >/tmp/Caddyfile; exec caddy run --config /tmp/Caddyfile --adapter caddyfile'`
- **Health check:** /healthz
- **Public domain:** Yes

### SpiceDB

- **Image:** authzed/spicedb:v1.56.0-debug@sha256:e88fb064b4301ca058ebb83f11f7250d58f411635bf476b6196941c297bb1470
- **Start command:** `spicedb serve`

### Postgres

- **Image:** postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777

## Documentation

# Deploy and Host SpiceDB on Railway

## About Hosting SpiceDB

SpiceDB is an Apache-2.0 permissions database inspired by Google Zanzibar. This template runs the official non-root 1.56.0 debug image because Railway pre-deploy migrations require its shell, with PostgreSQL, generated API authentication, Watch support, and a public REST gateway with dependency-aware health checks.

## Why Deploy SpiceDB on Railway

One click creates a durable authorization service while keeping its gRPC, metrics, and database listeners private. Applications can model relationships and evaluate permissions through the authenticated public HTTP API without operating a Kubernetes cluster.

## Common Use Cases

- Centralize fine-grained permissions across application services.
- Model organization, document, repository, and project relationships.
- Replace scattered role checks with consistent permission queries.

## Dependencies for SpiceDB Hosting

The template uses immutable SpiceDB, PostgreSQL, and Caddy images. SpiceDB runs datastore migrations before each deployment and PostgreSQL enables commit timestamps for Watch clients.

### Deployment Dependencies

- [SpiceDB](https://authzed.com/spicedb) stores relationships and evaluates permissions.
- [PostgreSQL](https://www.postgresql.org) persists schemas, relationships, revisions, and migrations.
- [Caddy](https://caddyserver.com) exposes the HTTP API and performs the database-aware health probe.
- [Railway](https://railway.com) provides private networking, generated secrets, deployment health checks, and persistent storage.


## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — Keycloak template with keywind theme + apple and discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/spicedb-relationship-authorization