9 days ago
Description of the issue:
I'm building a NestJS backend that needs to programmatically register custom
domains for tenant businesses (multi-tenant SaaS) via Railway's Public GraphQL
API (https://backboard.railway.com/graphql/v2), instead of doing it manually
via the CLI/dashboard for every customer. The goal is a domainCreate-style
mutation triggered from my own app whenever a business owner adds a custom
domain, so the CNAME target gets created automatically.
Every single request — even the simplest possible query ({ me { name email } })
— fails with "Not Authorized", regardless of token type or auth method used.
What I've tried (5 tokens total, all fail identically):
-
2x Project Tokens, sent with
Project-Access-Token: <token>header -
3x Account Tokens (created fresh at railway.com/account/tokens), sent with
Authorization: Bearer <token>header
Both methods match Railway's own documented usage
(https://docs.railway.com/integrations/api) exactly. First-party support
confirmed my request format was correct and pointed me back to Account
Tokens + Authorization: Bearer, but a brand-new Account Token created after
that reply still returns the same "Not Authorized" error, tested independently
from two different machines/networks.
Error messages and descriptions:
{"errors":[{"message":"Not Authorized", ...}]}
(no further detail in the payload)
Logs (build and/or deploy): N/A — this isn't a deploy issue, it's every call
to the Public API failing at the auth layer before it reaches any project/
service context.
What I need help with:
Is there an account-level flag/setting (e.g. 2FA state, workspace permissions,
token scope restriction) that could cause 100% of Account Token requests to
be rejected even though the token shows as valid/active in the dashboard? Has
anyone hit this and found a fix that isn't "create yet another token"?
3 Replies
9 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 9 days ago
9 days ago
IIRC scoped tokens cannot access account level operations such as me.
I’d try testing out queries with https://railway.com/graphiql.
0x5b62656e5d
IIRC scoped tokens cannot access account level operations such as `me`. I’d try testing out queries with https://railway.com/graphiql.
9 days ago
Thanks — that's correct for the 2 Project tokens I tested, and matches
what Railway support told me too (Project-Access-Token scoped tokens
can't call me).
But 3 of the 5 tokens I tested were Account Tokens sent with
Authorization: Bearer <token> specifically to query me — which
should be exactly the supported use case. Those failed identically
with "Not Authorized" as well. That's the part still unexplained.
I'll try the GraphiQL playground next and report back
alialmatrafi
Thanks — that's correct for the 2 Project tokens I tested, and matches what Railway support told me too (Project-Access-Token scoped tokens can't call `me`). But 3 of the 5 tokens I tested were Account Tokens sent with `Authorization: Bearer <token>` specifically to query `me` — which should be exactly the supported use case. Those failed identically with "Not Authorized" as well. That's the part still unexplained. I'll try the GraphiQL playground next and report back
9 days ago
Tested via GraphiQL (railway.com/graphiql) using my actual browser
session — no manual token at all. Same result:
{ "errors": [{ "message": "Not Authorized", "extensions": {
"code": "INTERNAL_SERVER_ERROR" } }] }
Note the code is INTERNAL_SERVER_ERROR, not UNAUTHENTICATED — this
looks like a server-side exception tied to my account specifically,
not a token/permissions issue on my end.