I'm planning AWS access from a Railway service and need to confirm the supported authentication options before implementation.

I added a clarification to the existing OIDC feature request. It is still Under Review. This question asks what is supported today; it is not another request for the same feature.

Does Railway currently issue workload identity tokens that a running service can exchange for short-lived AWS credentials? If so, could you link the official setup documentation, including supported plans, identity claims and token refresh?

If not, is there a supported way to provide a bootstrap credential only to the running service, excluding image builds and preview environments? The Variables documentation says sealed values are supplied to builds and deployments. It also says they are not copied to PR or duplicated environments, which helps with that part of isolation but leaves the build boundary unclear.

Please link the recommended pattern and any additional plan or service costs. If runtime-only injection is not supported, a clear confirmation would help us choose an alternative architecture.

This is a capability/documentation question, not an outage or a request to inspect or change a project. No project access or configuration changes are needed.