Deploy and Host SuperTokens on Railway

SuperTokens is open-source user authentication: email and password, passwordless, social login, sessions with refresh-token rotation, and multi-factor — running on your own infrastructure, with user data in your own database.

About Hosting SuperTokens

This template runs the SuperTokens core against a PostgreSQL instance on a persistent volume. The core is the stateful half of SuperTokens: it stores users, sessions and tokens, and your backend talks to it through a SuperTokens SDK. The frontend SDK never talks to the core directly.

The core gets a public domain so a backend deployed elsewhere can reach it; Postgres stays private.

Common Use Cases

Replacing Auth0 or Cognito: The same session and social-login features without per-monthly-active-user pricing, and with the user table in a database you can query.
Auth for a multi-service project: One core, several backends — Node, Python, Go — sharing sessions across them.
Compliance-driven self-hosting: Credentials and personal data stay in your Postgres, in a region you chose.

Dependencies for SuperTokens Hosting

Deployment Dependencies

SuperTokens core (PostgreSQL edition)
PostgreSQL 16 on a Railway volume
A SuperTokens backend SDK in your API, and the matching frontend SDK

Implementation Details

POSTGRESQL_CONNECTION_URI points the core at the database over the private network; the core creates and migrates its own schema on first boot, so there is nothing to run by hand.

The core has no authentication of its own. Anyone who can reach it can create users and mint sessions. It is on a public domain here because backends usually live outside the project — if yours runs in the same Railway project, remove the domain and use supertokens-core.railway.internal:3567 instead, which is both faster and not exposed. If you do need it public, put it behind an API key (API_KEYS) before you ship.

The three moving parts are worth knowing when you wire up an SDK: the frontend SDK handles the UI and token storage, your backend SDK verifies sessions and talks to the core, and the core is what this template runs. Getting the apiDomain and websiteDomain right in the SDK config is the usual source of first-day CORS problems.

Postgres carries the volume, so users and sessions survive redeploys.

Why Deploy SuperTokens on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying SuperTokens on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Resources: the core is a JVM service and sits around 300–400 MB; Postgres adds roughly 100 MB at rest. On the order of $8–12 a month for the pair at small scale.