a day ago
Hello Railway Support,
I’m running a private Next.js application with PostgreSQL on Railway and need to perform a one-time, read-only verification inside the application container using Railway CLI SSH.
Project details:
- Project: ibt-news-magazine
- Environment: production
- Service: considered-pack-private
- Railway CLI version: 5.62.1
- Current plan: Hobby
The application is intentionally private and currently has no Railway-generated domain or custom domain. We do not want to create a public domain, expose the service publicly, create another service, or change the plan or billing configuration.
We already have a project/environment token that was sufficient for deployment, but Railway CLI SSH requires a user-authenticated session. When we attempted the device-login flow, Railway CLI requested:
- openid email profile
- workspace:admin
- project:admin
- ssh_keys
- offline_access
The authorization screen defaulted to all workspaces and projects. It stated that workspace administration includes members, billing, settings, and creating, deploying, and deleting projects.
We do not want to grant workspace-wide administrative access, billing or membership control, access to unrelated projects, project-deletion authority, or persistent offline access merely to perform a temporary SSH verification.
Could you please clarify:
- Is there a supported way to authorize Railway CLI SSH for only one project, environment, or service?
- Can a project/environment token, short-lived token, one-time SSH certificate, or another limited credential be used for this?
- If we select only ibt-news-magazine using the “Change” option, does workspace:admin still apply to the entire workspace?
- Is offline_access mandatory for a temporary SSH session?
- If the broad CLI authorization is currently mandatory, what is the exact procedure for completely revoking the CLI session and any temporary SSH keys immediately after verification?
- Can you confirm whether there is any narrower recommended method for running read-only commands inside a private, domainless service?
We are trying to verify the deployed application without creating public networking or granting access beyond what the verification requires.
Thank you,
Stephen Gill
5 Replies
a day ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 23 hours ago
a day ago
- No. You need to use a workspace or account level token to use
railway ssh. - No.
- What do you mean by the "Change" option?
- Railway CLI requires what it needs.
- You can revoke a token and remove any SSH keys by going into the account settings and/or workspace settings.
- There isn't a way to gain only read-only access into a container. You can either use the Console tab of the service or use
railway ssh.
a day ago
Thank you.
0x5b62656e5d
1. No. You need to use a workspace or account level token to use `railway ssh`. 2. No. 3. What do you mean by the "Change" option? 4. Railway CLI requires what it needs. 5. You can revoke a token and remove any SSH keys by going into the account settings and/or workspace settings. 6. There isn't a way to gain only read-only access into a container. You can either use the Console tab of the service or use `railway ssh`.
a day ago
Thank you, Ben.
By the “Change” option, I mean the link on the Railway CLI device-authorization screen beneath “Authorize access to all workspaces and projects.” Selecting it appeared to allow choosing only the ibt-news-magazine project.
Could you clarify whether selecting only that project actually limits the OAuth authorization to that project, or whether the requested workspace:admin permission still applies across the entire workspace?
Also, regarding the service Console tab: can you confirm that it uses the existing Railway dashboard session without requiring an account/workspace token or a registered SSH key, and that the Console session is attached only to the selected service and environment?
We understand that the shell itself is not technically read-only; we would limit our use to non-modifying diagnostic commands.
19 hours ago
- I just tested it; despite scoping the CLI to access X project(s), it still somehow can access other projects... I'll look into this further.
- Yes, you don't need to create a new token or register an SSH key to use the Console tab of your service.
an hour ago
There is no project-scoped SSH token on Railway today, and that's the whole answer to questions 1-3: railway ssh / railway connect always need a user-authenticated session. Project and environment tokens are deploy/API-only — they cannot open SSH sessions, period.
The least-privilege flow for your one-time check is:
- Run
railway login. On the device-login screen, click "Change" and select ONLYibt-news-magazine— the grant then applies to that project alone, not the workspace, billing, or members. offline_accessis just the refresh token that keeps the CLI session alive between commands. For a one-time check it's fine — you revoke it right after.- Revoke when done: run
railway logout, then in the dashboard go to Account -> authorized sessions/devices and remove the CLI session, and delete the temporary SSH key from your account's SSH keys.
No persistent offline access remains after that — the refresh token is dead, the device session is gone, the key is deleted. There is no narrower read-only exec path for a domainless private service; scoped-login-then-revoke is the supported route.