5 hours ago
Hello Railway Support,
I'm preparing a secure OAuth callback gateway and need confirmation about how Railway handles newly staged sealed environment variables.
Railway CLI v5.66.0 appears to support submitting value and isSealed: true together using environmentStageChanges.
Before storing a production registration secret, could your engineering/security team confirm:
- Is the variable sealed before persistence, including while changes are staged?
- Can plaintext appear in raw configuration patches, API responses, deployment previews, audit records, errors, or retained history, including failed commits, discarded changes, and restaged versions?
- Can the operation be completed without committing changes, deploying, or restarting the service?
- What is the officially supported procedure for securely creating a new sealed variable?
The gateway's earlier deployment failed its health check because a required registration secret was not configured. Automatic deployments are now disabled, and the service remains offline.
No actual credentials or secret values are included in this request.
Written technical confirmation or official documentation would be appreciated.
Thank you.
1 Replies
5 hours ago
Yes, environmentStageChanges accepts a variable with both value and isSealed: true in one staged change, so a new variable can be created already sealed. The value is protected when the change is staged, not only once it is deployed, and staged changes read back through the API show a sealed value as ***. That applies whether the patch is staged, applying, committed, failed, or discarded. Workspace audit log entries for variable changes record the variable name and whether it is sealed, but not its value. Once sealed, the value is given to builds and deployments but can't be viewed in the UI or pulled from the API, isn't returned by railway variables or railway run, doesn't appear in environment sync diffs, and can't be unsealed (docs).
Staging the change on its own doesn't commit, deploy, or restart anything. The variable only reaches the service once you review and deploy the staged changes (staged changes), and your service needs that deploy to actually read the secret. The variableUpsert mutation can't set the sealed flag, so use environmentStageChanges with isSealed: true. If you use the dashboard, the documented flow is to add the variable and then choose Seal from its 3-dot menu, which leaves the value unsealed until that seal change is applied.
Status changed to Awaiting User Response Railway • about 5 hours ago