2 months ago
I using graphql api. trying to create service in project, when i use it Project access token or Workspace access token I get Not Authorized. I use Project-Access-Token and Team-Access-Token header respectively. I am able to create service in project using my Account access token, but it is too much permissions? Is it possible to create services with project access token? am i doing something wrong?
6 Replies
2 months ago
more info. despite i am being able to siccesfully execute request for service creation I do not see service in project on ui. i get success response:
{
"data": {
"serviceCreate": {
"__typename": "Service",
"createdAt": "2025-05-31T22:30:57.650Z",
"deletedAt": null,
"featureFlags": [],
"icon": null,
"id": ".....",
"name": "elegant-happiness",
"projectId": "....",
"templateServiceId": null,
"templateThreadSlug": null,
"updatedAt": "2025-05-31T22:30:57.650Z"
}
}
}
2 months ago
with project token this works:
query {
projectToken {
environmentId
projectId
}
}
but with that env id
query {
environment(id: "id from prev query") {
id
}
}
i get this:
{
"errors": [
{
"message": "Not Authorized",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": [
"environment"
],
"extensions": {
"code": "INTERNAL_SERVER_ERROR"
},
"traceId": "4535503427518470711"
}
],
"data": null
}
2 months ago
A project token is scoped to just an environment in a project. But a service belongs to all environments of the project. Therefore, you won't be able to use the project token to create a service. I recommend using the team token for it. If the
Team-Access-Token
token header doesn't work, try to use it the same way you use an account token, and it should work.Creating a service in a project might take some time to show up in the UI. You can confirm its existence by using the query below. If you are still unable to see it after a long time, I would recommend deleting it using API and re-creating it.
The following is what I use to debug API issues.
query readProject {
project(
id: "YOUR_PROJECT_ID_HERE"
) {
id
volumes {
edges {
node {
id
name
volumeInstances {
edges {
node {
id
serviceId
environmentId
}
}
}
}
}
}
services {
edges {
node {
id
name
serviceInstances {
edges {
node {
id
region
environmentId
numReplicas
latestDeployment {
id
meta
}
source {
repo
image
}
domains {
customDomains {
id
domain
status {
cdnProvider
certificateStatus
dnsRecords {
currentValue
fqdn
hostlabel
purpose
recordType
requiredValue
status
zone
}
}
}
serviceDomains {
id
domain
suffix
targetPort
}
}
}
}
}
}
}
}
}
}
If you are using the API to provision infrastructure, I would recommend the following Terraform provider. https://github.com/terraform-community-providers/terraform-provider-railway
pksunkara
A project token is scoped to just an environment in a project. But a service belongs to all environments of the project. Therefore, you won't be able to use the project token to create a service. I recommend using the team token for it. If the Team-Access-Token token header doesn't work, try to use it the same way you use an account token, and it should work.Creating a service in a project might take some time to show up in the UI. You can confirm its existence by using the query below. If you are still unable to see it after a long time, I would recommend deleting it using API and re-creating it.The following is what I use to debug API issues.query readProject { project( id: "YOUR_PROJECT_ID_HERE" ) { id volumes { edges { node { id name volumeInstances { edges { node { id serviceId environmentId } } } } } } services { edges { node { id name serviceInstances { edges { node { id region environmentId numReplicas latestDeployment { id meta } source { repo image } domains { customDomains { id domain status { cdnProvider certificateStatus dnsRecords { currentValue fqdn hostlabel purpose recordType requiredValue status zone } } } serviceDomains { id domain suffix targetPort } } } } } } } } } }If you are using the API to provision infrastructure, I would recommend the following Terraform provider. https://github.com/terraform-community-providers/terraform-provider-railway
2 months ago
A project token is scoped to just an environment in a project. But a service belongs to all environments of the project.
wait. isn't service belong to environment? i am trying to create service under environment. anyway nor project nor team token worked for me. i was able to do it using account token but it is too much permission.
2 months ago
A serviceInstance
belongs to an environment. service
belongs to the project. When you create a service, it creates a service
and for each environment creates a serviceInstance
(unless specified otherwise by giving it environmentId
as an input, but this only works for PR environments).
Have you tried with the team token using Authorization: Bearer <token>
header? I just tested and it worked.
pksunkara
A serviceInstance belongs to an environment. service belongs to the project. When you create a service, it creates a service and for each environment creates a serviceInstance (unless specified otherwise by giving it environmentId as an input, but this only works for PR environments). Have you tried with the team token using Authorization: Bearer <token> header? I just tested and it worked.
2 months ago
thanks! yes team token works with bearer. so there is not way to create service instance with project token? I do not feel like it is good solution to use team token with access to all my projects just to create service instances in one project in one env
Status changed to Solved chandrika • 2 months ago