---
title: "Deploy TokenHub"
description: "Enterprise LLM gateway: routing, quotas and usage for AI models"
category: "AI/ML"
url: https://railway.com/deploy/tokenhub
---

# Deploy TokenHub

Enterprise LLM gateway: routing, quotas and usage for AI models

**[Deploy TokenHub on Railway](https://railway.com/template/tokenhub)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/tokenhub/manifest.json

- **Creator:** My Projects
- **Category:** AI/ML

## Template content

### Console https://raw.githubusercontent.com/astaxie/TokenHub/main/frontend/public/brand/tokenhub-logo.png

- **Image:** ghcr.io/astaxie/tokenhub-backend:latest
- **Health check:** /
- **Public domain:** Yes

### TokenHub https://raw.githubusercontent.com/astaxie/TokenHub/main/frontend/public/brand/tokenhub-logo.png

- **Image:** ghcr.io/astaxie/tokenhub-backend:latest
- **Health check:** /readyz
- **Public domain:** Yes

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18

## Documentation

# Deploy and Host TokenHub on Railway

[TokenHub](https://github.com/astaxie/TokenHub) is an open-source enterprise LLM gateway. It gives a company one private, OpenAI-compatible endpoint in front of many AI model providers, with routing and failover, per-team and per-key quotas, usage and cost tracking, audit logs and an admin console.

## About Hosting TokenHub

This template runs TokenHub from the official image as two services plus a database:

- **TokenHub**: the Go API and model gateway (`/v1/*`, `/api/*`, `/docs`), public domain on port 8080, with a volume at /app/data for installed plugins.
- **Console**: the Next.js admin console from the same image, public domain on port 3000. It talks to the TokenHub API from your browser.
- **Postgres**: Railway's PostgreSQL, used for all users, keys, routing config and usage records.
- **Generated secrets**: an admin password for the `admin` user, an admin API token and an encryption root key are generated for every deploy. Nothing ships with a known default password.
- **Auth**: every admin and gateway endpoint requires a login session, the admin token or a TokenHub API key.

**After deploy:**

1. Open the TokenHub service, Variables tab, and copy `TOKENHUB_BOOTSTRAP_ADMIN_PASSWORD`.
2. Open the Console service's public URL and sign in as `admin` with that password. Change the password under your profile afterwards.
3. In the console add a Provider and paste your upstream API key (OpenAI, Anthropic, Gemini, Azure, and many more). Keys are stored encrypted in Postgres.
4. Create a project and an API key, then point your OpenAI-compatible client at `https://YOUR-RAILWAY-DOMAIN/v1` (the TokenHub service domain).

## Common Use Cases

- Give every team one internal endpoint for many LLM providers, with keys kept out of client apps.
- Enforce per-team, per-user and per-key budgets and rate limits.
- Track token usage and cost per project for chargeback.
- Fail over between providers and accounts when an upstream is down or rate limited.

## Dependencies for TokenHub Hosting

- Source: [astaxie/TokenHub](https://github.com/astaxie/TokenHub) (Apache-2.0)
- Image: `ghcr.io/astaxie/tokenhub-backend:latest`
- At least one model provider API key, added in the console after deploy.

### Deployment Dependencies

- [TokenHub repository](https://github.com/astaxie/TokenHub)
- [TokenHub deployment guide](https://github.com/astaxie/TokenHub/blob/main/docs/deployment.md)
- [Railway PostgreSQL](https://docs.railway.com/guides/postgresql)

### Implementation Details

- The image normally runs the API and console in one container behind a reverse proxy. On Railway the same image runs twice with `TOKENHUB_RUN_MODE=backend` and `TOKENHUB_RUN_MODE=frontend`, so each gets its own HTTPS domain and no proxy is needed. CORS on the API allows only the console domain.
- PostgreSQL replaces the default SQLite so data lives in a managed database, and the API connects over Railway's private network.
- `TOKENHUB_ENV=prod` makes TokenHub refuse weak or placeholder secrets at startup.
- The in-app self-updater is turned off because the release directory is not on a volume. Update by redeploying the service to pull a newer image.
- Do not change `TOKENHUB_SECRET_KEY` after the first deploy: stored provider keys are encrypted with it.

## Why Deploy TokenHub on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying TokenHub on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

## Similar templates

- [Chat Chat](https://railway.com/deploy/-WWW5r) — Chat Chat, your own unified chat and search to AI platform.
- [Weaviate](https://railway.com/deploy/weaviate-1) — Vector database with hybrid search and an API key-protected API
- [Möbius Personal AI OS](https://railway.com/deploy/mobius-v01-personal-ai-os) — Self-hosted AI agent that builds and runs apps for you, with memory.

Open this page in a browser: https://railway.com/deploy/tokenhub