24 days ago
The SSH Key implementation is confusing and so far my searches have not yielded any documentation that explains how it is supposed to work.
I have an SSH key registered to my workspace. I have a project in the workspace that has a postgres database. When I try to use railway connect when linked to the project, it tells me my SSH key isn't registered and asks if I would like to. Then it fails because it says the key is registered elsewhere.
My assumption was that a workspace ssh key would work for all projects in the workspace, but it seems that only applies if you are not using the cli. Since I don't want a metric ton of SSH keys to manage, I decided to mint a workspace token to use with the CLI. I exported RAILWAY_API_TOKEN, and I get Unauthorized. Please check that your RAILWAY_API_TOKEN is valid and has access to the resource you're trying to use. The token is valid and scoped to the workspace in question. So apparently the workspace API token can't be used to authenticate the CLI either.
I know that I shouldn't compare products, but my expectation is that a workspace ssh key works across the entire workspace -- similar to setting an org level key in GitHub, or a team-level key in Digital Ocean.
How can I use a workspace key with the CLI?
5 Replies
24 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 24 days ago
24 days ago
this sounds a bit like a bug, but in the meantime could you try removing the key via railway ssh keys remove —workspace id_here
and then generate a new, user wide one with railway ssh keys add
milo
this sounds a bit like a bug, but in the meantime could you try removing the key via railway ssh keys remove —workspace id_here and then generate a new, user wide one with railway ssh keys add
24 days ago
It feels like a couple of bugs to me. I feel like the API TOKEN should work with the CLI, and the CLI should be able to see and use workspace level SSH keys.
24 days ago
But what are workspace ssh keys used for then? It seems pointless and poorly documented.
24 days ago
"Workspace keys are the shared Admin-managed pool for every service in that workspace" but to what end? I set up workspace keys because what you describe is exactly what I want. But they don't work. So I can manage them all day long, but I can't actually use them.
And if I build things that can only use my personal key, they break as soon as my account is deactivated.
I get that I need to suck it up and create a new key -- it's getting to the point where I need something to manage ssh keys like something manages passwords. But I can't wrap my head around what the workspace keys are for, if I can't actually use them.
21 days ago
RAILWAY_API_TOKEN → Unauthorized
RAILWAY_TOKEN = project; RAILWAY_API_TOKEN = account/workspace. Only one may be set (CLI, login). A leftover project token (or both) breaks broader commands. Prefer railway login for interactive connect/ssh.
Undocumented gap: docs say workspace keys grant SSH to every service, but don’t cover interactive login with only workspace keys. CLI register flow targets the personal pool — keep a personal key for CLI even if workspace keys exist.