2 days ago
The SSH Key implementation is confusing and so far my searches have not yielded any documentation that explains how it is supposed to work.
I have an SSH key registered to my workspace. I have a project in the workspace that has a postgres database. When I try to use railway connect when linked to the project, it tells me my SSH key isn't registered and asks if I would like to. Then it fails because it says the key is registered elsewhere.
My assumption was that a workspace ssh key would work for all projects in the workspace, but it seems that only applies if you are not using the cli. Since I don't want a metric ton of SSH keys to manage, I decided to mint a workspace token to use with the CLI. I exported RAILWAY_API_TOKEN, and I get Unauthorized. Please check that your RAILWAY_API_TOKEN is valid and has access to the resource you're trying to use. The token is valid and scoped to the workspace in question. So apparently the workspace API token can't be used to authenticate the CLI either.
I know that I shouldn't compare products, but my expectation is that a workspace ssh key works across the entire workspace -- similar to setting an org level key in GitHub, or a team-level key in Digital Ocean.
How can I use a workspace key with the CLI?
5 Replies
2 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 2 days ago
2 days ago
this sounds a bit like a bug, but in the meantime could you try removing the key via railway ssh keys remove —workspace id_here
and then generate a new, user wide one with railway ssh keys add
milo
this sounds a bit like a bug, but in the meantime could you try removing the key via railway ssh keys remove —workspace id_here and then generate a new, user wide one with railway ssh keys add
2 days ago
It feels like a couple of bugs to me. I feel like the API TOKEN should work with the CLI, and the CLI should be able to see and use workspace level SSH keys.
2 days ago
But what are workspace ssh keys used for then? It seems pointless and poorly documented.
2 days ago
"Workspace keys are the shared Admin-managed pool for every service in that workspace" but to what end? I set up workspace keys because what you describe is exactly what I want. But they don't work. So I can manage them all day long, but I can't actually use them.
And if I build things that can only use my personal key, they break as soon as my account is deactivated.
I get that I need to suck it up and create a new key -- it's getting to the point where I need something to manage ssh keys like something manages passwords. But I can't wrap my head around what the workspace keys are for, if I can't actually use them.
an hour ago
railway connect / railway ssh authenticate as YOU, not your workspace — so the CLI ignores workspace keys entirely. That's why it says the key isn't registered.
- The "registered elsewhere" error is the tell: one public key can't live on both the workspace and your user account. Generate a dedicated key for the CLI:
ssh-keygen -t ed25519 -f ~/.ssh/railway_cli, and add the PUBLIC key to your user account (dashboard -> Account -> SSH keys), not the workspace. - Log the CLI in as yourself:
railway login, thenrailway linkyour project, thenrailway connect— accept when it offers to register your key. - Keep workspace keys where they are; they're for workspace/dashboard flows, never the CLI's key source.
RAILWAY_API_TOKENis API/CI-only by design — it can never authenticate SSH. The CLI needs a user session, full stop.
One key on your account, logged in via railway login, and connect works.