My team uses 1Password to manage our app secrets and would like to use 1Password Credential Broker with our Railway services. That would let our services pull secrets with short-lived access instead of storing a long-lived token in Railway Variables.

Credential Broker requires the hosting platform to issue a workload identity (OIDC) token to each running service, which Railway doesn’t support today.

What we’d need:

A signed OIDC token available to each service (env var or file path)

A stable issuer and JWKS endpoint

Claims for project, environment, and service so we can write tight trust policies

I know this has been asked for previously but don't see it on the roadmap yet. Would love to see this prioritized given the October cybersecurity incident. Happy to be an early tester!