an hour ago
I am preparing a fixed-command diagnostic inside an existing Railway service. It should return aggregate results only and keep runtime secrets inside the container. No live access has occurred from this automation, and this request does not authorise any production changes.
The published CLI v5.71.0 uses native SSH; authenticated HTTPS service discovery is separate. I could not find a shipped SSH host-key pin. Before proceeding, I need a supported way to verify the gateway rather than blindly accepting the first key or disabling host checking.
Please clarify:
- Where is the current SSH gateway public host key or host CA published through an authenticated official channel, and how should key changes be verified?
- Can temporary access be restricted to one running service/deployment and one fixed command? If not, what is the minimum access scope and how is it revoked?
- Is there another supported certificate-verified remote-command route that avoids separate SSH gateway trust?
This is a platform trust/access question, not a request for application debugging, database credentials, SQL execution or a production change. My assistant recommended contacting Railway after reviewing the published CLI source. Please provide verification/access guidance only.
Prepared with Railway's support template (v1).
3 Replies
an hour ago
We don't publish a host key, fingerprint list, SSHFP record, or host CA for ssh.railway.com, and none are planned. The endpoint is served by multiple hosts, each with its own key, and those hosts change without notice, so the presented key can differ between connections and over time. We also don't attest individual fingerprints, so there is no Railway procedure for verifying key changes, and how you handle host key trust for this endpoint is your decision.
Access is granted through registered SSH keys, not per-command grants. A key registered on your personal account works with services your account can reach, and a workspace-owned key grants SSH access to every service in that workspace. You can target a single service and deployment instance with railway ssh --service <service> --deployment-instance <id> -- <command>, but that narrows where the command runs rather than what the key is allowed to do. Revoking access means removing the key with railway ssh keys remove (or with --workspace for workspace keys). See the railway ssh docs for the full options.
Status changed to Awaiting User Response Railway • about 1 hour ago
Railway
We don't publish a host key, fingerprint list, SSHFP record, or host CA for `ssh.railway.com`, and none are planned. The endpoint is served by multiple hosts, each with its own key, and those hosts change without notice, so the presented key can differ between connections and over time. We also don't attest individual fingerprints, so there is no Railway procedure for verifying key changes, and how you handle host key trust for this endpoint is your decision. Access is granted through registered SSH keys, not per-command grants. A key registered on your personal account works with services your account can reach, and a workspace-owned key grants SSH access to every service in that workspace. You can target a single service and deployment instance with `railway ssh --service <service> --deployment-instance <id> -- <command>`, but that narrows where the command runs rather than what the key is allowed to do. Revoking access means removing the key with `railway ssh keys remove` (or with `--workspace` for workspace keys). See the [railway ssh docs](https://docs.railway.com/cli/ssh) for the full options.
an hour ago
Thank you. We understand that Railway does not publish or attest the SSH gateway's keys, and that registered SSH keys are not restricted to one command. We will not disable host verification or register SSH access for this diagnostic.
Please answer the remaining third question: is there a currently supported remote-command route over certificate-verified HTTPS or an OAuth-backed control plane that does not require trusting the SSH gateway's unverified key? If yes, please link the official documentation and explain its access scope and revocation method. If none exists, please confirm that explicitly.
Please seek human engineering confirmation of this specific remaining question if available. This request is for platform guidance only; it does not authorise production connections or changes.
Prepared with Railway's support template (v1).
Status changed to Awaiting Railway Response Railway • 44 minutes ago
39 minutes ago
We don't currently offer a supported remote-command route over certificate-verified HTTPS or an OAuth-backed control plane that avoids the SSH gateway. The ways we provide to run a command inside a running service, railway ssh in the CLI and the Console in the dashboard, both go through the same SSH gateway, so neither removes the need to trust its host key.
railway run is not an alternative here, since it runs the command on your own machine with the service's variables injected rather than inside the container. The railway ssh and railway run docs cover both commands.
Status changed to Awaiting User Response Railway • 39 minutes ago