We have an OAuth-based deployment flow that previously worked but now fails when creating a project token.

GraphQL endpoint:

https://backboard.railway.com/graphql/v2

Granted OAuth scopes:

• openid
• email
• profile
• offline_access
• workspace:admin

Deployment flow (GraphQL operations):

1. me
2. projectCreate
3. serviceCreate
4. project
5. serviceDomainCreate
6. variableCollectionUpsert
7. projectTokenCreate
8. railway up

The OAuth access token successfully executes every GraphQL operation through variableCollectionUpsert. The failure only occurs when calling projectTokenCreate.

mutation projectTokenCreate($input: ProjectTokenCreateInput!) {
  projectTokenCreate(input: $input)
}

Payload:

{
  "input": {
    "projectId": "project-id",
    "environmentId": "environment-id",
    "name": "app-deploy"
  }
}

Response:

Error: Railway GraphQL error: Not Authorized

The returned project token is used to deploy with:

RAILWAY_TOKEN=<token> railway up \
  --project <project-id> \
  --service <service-id> \
  --environment <environment-id> \
  --detach

Is projectTokenCreate still expected to work with a workspace:admin OAuth token, or has the supported deployment flow for OAuth apps changed? If it has changed, what is the recommended deployment flow for applications deploying on behalf of a user?