--- title: "Security" description: "Manage secrets, add authentication, lock down projects and meet compliance requirements." url: https://railway.com/guides/topics/security guides: 14 last_updated: 2026-11-05T19:07:19.006Z --- # Security Manage secrets, add authentication, lock down projects and meet compliance requirements. ## Get started 1. [Run Code-Execution Sandboxes for AI Agents](https://railway.com/guides/code-execution-sandboxes.md): Run AI-generated code in isolated, disposable sandboxes on Railway. What a code-execution sandbox is, why agents need one, and how to create, checkpoint, fork, and destroy sandboxes from the CLI or the TypeScript SDK. 2. [Self-Host Keycloak for Authentication](https://railway.com/guides/keycloak-authentication.md): Deploy Keycloak on Railway with a Postgres database, an admin account, and a public domain. Configure a realm and an OIDC client for your applications. 3. [Self-host Supabase with Postgres, Auth, and Storage](https://railway.com/guides/supabase.md): Deploy the Supabase stack on Railway with Postgres, GoTrue auth, PostgREST API, storage, and the Studio dashboard. Covers multi-service setup and JWT configuration. ## Build and deploy - [Add Authentication to a Frontend Application](https://railway.com/guides/frontend-authentication.md): Implement authentication in a frontend application deployed on Railway. Covers third-party providers (Clerk, Supabase Auth), session-based auth with Postgres, and common deployment pitfalls. - [Deploy Authorizer on Railway](https://railway.com/guides/authorizer.md): In this post, we go over the process of deploying Authorizer (an open-source authentication and authorization solution) instance on Railway! ## Run in production - [Rotate API Keys and Database Credentials Without Downtime](https://railway.com/guides/rotate-credentials-zero-downtime.md): Use the dual-key overlap pattern, staged redeploys, and reference variables to rotate secrets on Railway with zero downtime. - [Lock Down a Production Railway Project](https://railway.com/guides/lock-down-production-project.md): Harden a production Railway project with Under Attack Mode, private networking, scoped API tokens, sealed variables, and workspace-level access controls. - [Deploy Node.js & Express API with Autoscaling, Secrets, and Zero Downtime](https://railway.com/guides/deploy-node-express-api-with-auto-scaling-secrets-and-zero-downtime.md): Learn how to deploy Node.js and Express applications with automatic scaling, environment secrets, zero-downtime updates, and preview environments, all without managing servers or learning Kubernetes/container orchestration. - [Secure Cloud Hosting for Compliance: A Practical Guide for Startups and Regulated Industries](https://railway.com/guides/secure-cloud-hosting-for-compliance.md): A practical guide to running regulated workloads on modern cloud platforms. Covers what SOC 2, GDPR, HIPAA, PCI, and ISO 27001 actually require, which controls your provider handles, and how to configure the rest yourself using clear checklists and data-flow audits. Ideal for startups and SaaS teams that need compliance without self-managing infrastructure. ## Compare and decide - [Handle Build-Time vs Runtime Secrets in Docker Builds](https://railway.com/guides/build-time-vs-runtime-secrets.md): When Docker builds on Railway can see your variables, how to pass build secrets with ARG, and why runtime secrets should never be baked into the image. ## More guides - [Isolate Staging from Production for Compliance](https://railway.com/guides/isolate-staging-production.md): Separate staging and production on Railway with per-environment networks, per-environment bucket instances, and environment-scoped credentials. - [Sync Secrets from an External Secrets Manager](https://railway.com/guides/external-secrets-manager.md): Keep Doppler, Infisical, or Vault as your source of truth and push secrets into Railway variables with the Public API, a sync script, or a vendor integration. - [Managing Secrets on Railway](https://railway.com/guides/managing-secrets-on-railway.md): How to store API keys, database URLs, and other secrets on Railway using service, shared, reference, and sealed variables, with no separate secrets manager. - [Compliance Isn't a Feature, It's a Posture](https://railway.com/guides/compliance-isnt-a-feature-its-a-posture.md): A SOC 2 attestation tells you what a vendor was doing twelve months ago. Compliance is a posture, an operational discipline you can evaluate by looking at defaults, postmortems, and engineer ownership. The sequel to The F in SOC2 Stands for Functional. ## Related topics - [CI/CD](https://railway.com/guides/topics/ci-cd.md): Preview environments, GitHub Actions, monorepos, config as code and safe rollbacks. - [Containers and Hosting](https://railway.com/guides/topics/containers.md): Deploy from Docker and Compose, self-host open-source tools, and scale across replicas and regions. - [Storage](https://railway.com/guides/topics/storage.md): Run Postgres, Redis, MySQL and object storage on Railway: pooling, backups, migrations and vector search. - [Frontend](https://railway.com/guides/topics/frontend.md): Ship Next.js, Astro, SvelteKit and SPAs, and run Node.js, Bun and full-stack TypeScript apps. - [Comparisons and Migrations](https://railway.com/guides/topics/comparisons.md): How Railway compares with other platforms, what it costs, and how to move over from Heroku, AWS and others. - [AI Agents](https://railway.com/guides/topics/ai.md): Host agents, MCP servers, RAG pipelines, model gateways and inference services.