Security

Manage secrets, add authentication, lock down projects and meet compliance requirements.

Get started

3 guides, in order
  1. Step 1Run Code-Execution Sandboxes for AI AgentsRun AI-generated code in isolated, disposable sandboxes on Railway. What a code-execution sandbox is, why agents need one, and how to create, checkpoint, fork, and destroy sandboxes from the CLI or the TypeScript SDK.
  2. Step 2Self-Host Keycloak for AuthenticationDeploy Keycloak on Railway with a Postgres database, an admin account, and a public domain. Configure a realm and an OIDC client for your applications.
  3. Step 3Self-host Supabase with Postgres, Auth, and StorageDeploy the Supabase stack on Railway with Postgres, GoTrue auth, PostgREST API, storage, and the Studio dashboard. Covers multi-service setup and JWT configuration.

Build and deploy

2 guides
Add Authentication to a Frontend ApplicationImplement authentication in a frontend application deployed on Railway. Covers third-party providers (Clerk, Supabase Auth), session-based auth with Postgres, and common deployment pitfalls.Deploy Authorizer on RailwayIn this post, we go over the process of deploying Authorizer (an open-source authentication and authorization solution) instance on Railway!

Run in production

4 guides
Rotate API Keys and Database Credentials Without DowntimeUse the dual-key overlap pattern, staged redeploys, and reference variables to rotate secrets on Railway with zero downtime.Lock Down a Production Railway ProjectHarden a production Railway project with Under Attack Mode, private networking, scoped API tokens, sealed variables, and workspace-level access controls.Deploy Node.js & Express API with Autoscaling, Secrets, and Zero DowntimeLearn how to deploy Node.js and Express applications with automatic scaling, environment secrets, zero-downtime updates, and preview environments, all without managing servers or learning Kubernetes/container orchestration.Secure Cloud Hosting for Compliance: A Practical Guide for Startups and Regulated IndustriesA practical guide to running regulated workloads on modern cloud platforms. Covers what SOC 2, GDPR, HIPAA, PCI, and ISO 27001 actually require, which controls your provider handles, and how to configure the rest yourself using clear checklists and data-flow audits. Ideal for startups and SaaS teams that need compliance without self-managing infrastructure.

Compare and decide

1 guide
Handle Build-Time vs Runtime Secrets in Docker BuildsWhen Docker builds on Railway can see your variables, how to pass build secrets with ARG, and why runtime secrets should never be baked into the image.

More guides

4 guides
Isolate Staging from Production for ComplianceSeparate staging and production on Railway with per-environment networks, per-environment bucket instances, and environment-scoped credentials.Sync Secrets from an External Secrets ManagerKeep Doppler, Infisical, or Vault as your source of truth and push secrets into Railway variables with the Public API, a sync script, or a vendor integration.Managing Secrets on RailwayHow to store API keys, database URLs, and other secrets on Railway using service, shared, reference, and sealed variables, with no separate secrets manager.Compliance Isn't a Feature, It's a PostureA SOC 2 attestation tells you what a vendor was doing twelve months ago. Compliance is a posture, an operational discipline you can evaluate by looking at defaults, postmortems, and engineer ownership. The sequel to The F in SOC2 Stands for Functional.