We don't publish a fingerprint list or known_hosts entry for ssh.railway.com, and we can't confirm or deny a specific fingerprint. The endpoint is served by multiple hosts, each with its own key, and those hosts change without notice, so the fingerprint you see can differ between connections and change over time.

How you handle host key trust for this endpoint is your call.

Thank you for the response.

I understand that Railway does not publish a fixed SSH host key fingerprint.

However, I need to securely connect to my production MariaDB service to download a database backup.

Is there an officially recommended way to verify the SSH server's identity on the first connection, or a secure alternative for downloading a backup without accepting an unverified SSH host key?

I would appreciate guidance from a Railway support team member.

Thank you!

We don't offer a procedure for verifying the ssh.railway.com host key on first connection. The endpoint's host keys change at any time, so there is no fixed key to check against.

If you'd rather not use SSH for the backup, you can enable a TCP Proxy on your MariaDB service. That exposes the database port publicly, so you can connect with your usual MariaDB client from your own machine and run the dump there. You can remove the proxy when you're done if you don't want the database reachable from outside your project.