GitHub Actions and GitLab Runners both support the concept of OIDC Tokens issued as part of a trusted CI/CD environment.

In lieu of static keys embedded into secrets files, it would be nice if Railway were to consume this OIDC credential for deployment purposes. Railway would take a token, verify that the project the token is running in is allowed to deploy (potentially even checking the branch or reference), and handing the appropriate CI action(s).

Solutions for this have been shipped by AWS, Vercel, and other cloud providers.

Generally, this is in line with the concept of workload identities, and would exist to reduce the number of static credentials/API keys that would need to be placed everywhere, and would simplify project administration.