Deploy and Host TokenHub on Railway

TokenHub is an open-source enterprise LLM gateway. It gives a company one private, OpenAI-compatible endpoint in front of many AI model providers, with routing and failover, per-team and per-key quotas, usage and cost tracking, audit logs and an admin console.

About Hosting TokenHub

This template runs TokenHub from the official image as two services plus a database:

TokenHub: the Go API and model gateway (/v1/*, /api/*, /docs), public domain on port 8080, with a volume at /app/data for installed plugins.
Console: the Next.js admin console from the same image, public domain on port 3000. It talks to the TokenHub API from your browser.
Postgres: Railway's PostgreSQL, used for all users, keys, routing config and usage records.
Generated secrets: an admin password for the admin user, an admin API token and an encryption root key are generated for every deploy. Nothing ships with a known default password.
Auth: every admin and gateway endpoint requires a login session, the admin token or a TokenHub API key.

After deploy:

Open the TokenHub service, Variables tab, and copy TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD.
Open the Console service's public URL and sign in as admin with that password. Change the password under your profile afterwards.
In the console add a Provider and paste your upstream API key (OpenAI, Anthropic, Gemini, Azure, and many more). Keys are stored encrypted in Postgres.
Create a project and an API key, then point your OpenAI-compatible client at https://YOUR-RAILWAY-DOMAIN/v1 (the TokenHub service domain).

Common Use Cases

Give every team one internal endpoint for many LLM providers, with keys kept out of client apps.
Enforce per-team, per-user and per-key budgets and rate limits.
Track token usage and cost per project for chargeback.
Fail over between providers and accounts when an upstream is down or rate limited.

Dependencies for TokenHub Hosting

Source: astaxie/TokenHub (Apache-2.0)
Image: ghcr.io/astaxie/tokenhub-backend:latest
At least one model provider API key, added in the console after deploy.

Deployment Dependencies

Implementation Details

The image normally runs the API and console in one container behind a reverse proxy. On Railway the same image runs twice with TOKENHUB_RUN_MODE=backend and TOKENHUB_RUN_MODE=frontend, so each gets its own HTTPS domain and no proxy is needed. CORS on the API allows only the console domain.
PostgreSQL replaces the default SQLite so data lives in a managed database, and the API connects over Railway's private network.
TOKENHUB_ENV=prod makes TokenHub refuse weak or placeholder secrets at startup.
The in-app self-updater is turned off because the release directory is not on a volume. Update by redeploying the service to pull a newer image.
Do not change TOKENHUB_SECRET_KEY after the first deploy: stored provider keys are encrypted with it.

Why Deploy TokenHub on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying TokenHub on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.