railway ssh

Open an interactive shell session inside a deployed Railway service container, or manage the SSH keys registered with your Railway account.

Railway uses your system ssh client to connect to ssh.railway.com. You must have an SSH key registered with Railway before you can connect. The CLI prompts you to register a local key the first time you run railway ssh.

Usage

railway ssh [OPTIONS] [COMMAND...]
railway ssh config [OPTIONS] [COMMAND]
railway ssh keys [SUBCOMMAND] [OPTIONS]

Options

Examples

Interactive shell

railway ssh

Opens an interactive shell in the service container.

Run a single command

railway ssh -- ls -la

PTY allocation is autodetected. Interactive tools like vim or htop work when both stdin and stdout are terminals; piped input runs without a PTY so output stays clean for scripts and CI.

Persistent tmux session

railway ssh --session

Connects inside a tmux session named railway. If the connection drops, the CLI reconnects and reattaches to the same session. Pass a name to use a different session:

railway ssh --session debug

Railway installs tmux in the container automatically if it isn't already installed.

Connect to a specific deployment instance

railway ssh --deployment-instance <instance-id>

Use a specific identity file

railway ssh -i ~/.ssh/railway_ed25519

When set, the CLI skips its local ~/.ssh scan and forwards the key directly to ssh.

Connect to a service without a public domain

The SSH username is the service's domain, so a service that has no domain needs a different target. Use its service instance ID instead.

1. Open the service in the dashboard.
2. Open the command palette with CMD + K (Mac) or Ctrl + K (Windows).
3. Choose Copy Service Instance ID.

That ID works as the username anywhere a domain does:

ssh <service-instance-id>@ssh.railway.com
scp <service-instance-id>@ssh.railway.com:/app/data.json ./data.json

The palette also offers Copy Service ID, which is a different value and is not a valid SSH target.

Copy files with scp and sftp

Railway SSH supports the SFTP subsystem, so your system scp and sftp clients work against ssh.railway.com using the same registered key. Use the service's domain as the username, or its service instance ID if it has no domain.

# Copy a file out of the container
scp myapp.up.railway.app@ssh.railway.com:/app/data.json ./data.json

# Copy a file into the container
scp ./data.json myapp.up.railway.app@ssh.railway.com:/app/data.json

# Copy a directory
scp -r myapp.up.railway.app@ssh.railway.com:/app/logs ./logs

# Open an interactive SFTP session
sftp myapp.up.railway.app@ssh.railway.com

A deployment instance ID works as the username too, in place of the domain.

scp uses the SFTP protocol on OpenSSH 9.0 and newer. On older clients, pass -s to select it.

If you added a host alias with railway ssh config, use the alias instead:

scp railway-api:/app/data.json ./data.json

Transfers reach the running container's filesystem, including any mounted volume. For volume files specifically, railway volume browse gives you an interactive browser without setting up SSH.

Forward a port with ssh -L

Railway SSH supports local port forwarding, so you can open an SSH tunnel from your own machine to a port inside your container.

ssh -N -L 8080:127.0.0.1:8080 myapp.up.railway.app@ssh.railway.com

The connection is dialed from inside the container, so 127.0.0.1 is the container's own loopback. -N skips the shell, so the command does nothing but hold the tunnel open. Keep the session running while you use the tunnel.

Forwarding is limited to the container's loopback and your project's private network. Public destinations are refused, so an SSH tunnel can't be used as a general internet proxy.

Manage SSH config

Use the config subcommand to add, preview, or remove a Railway OpenSSH config block for a service.

railway ssh config [OPTIONS] [COMMAND]

Subcommands

Add or update SSH config

railway ssh config --service api

Adds or updates the Railway block in ~/.ssh/config for the selected service.

Preview SSH config

railway ssh config --service api --dry-run

Prints the generated block without writing the SSH config file.

Use a custom host alias

railway ssh config --service api --alias railway-api

Sets the Host alias in the generated OpenSSH config block.

Remove SSH config

railway ssh config remove --service api

Removes the Railway block for the selected service from the SSH config file.

Options for

Options for

Manage SSH keys

Use the keys subcommand to register, list, and remove SSH keys for your Railway account or workspace.

railway ssh keys [SUBCOMMAND] [OPTIONS]

Subcommands

Options

List registered keys

railway ssh keys

Add a key

railway ssh keys add --key ~/.ssh/id_ed25519.pub --name "laptop"

Run without flags to pick from your local ~/.ssh keys interactively.

Remove a key

railway ssh keys remove

Import keys from GitHub

railway ssh keys github

GitHub keys belong to your personal account and can't be imported directly into a workspace. To register a GitHub key for a workspace, import it first, then add it with --workspace.

Workspace-owned keys

Workspace keys grant SSH access to every service in the workspace. Adding or removing workspace keys requires workspace Admin access.

railway ssh keys --workspace <workspace-id>
railway ssh keys add --workspace <workspace-id> --key ~/.ssh/id_ed25519.pub

When you authenticate with a workspace-scoped RAILWAY_API_TOKEN, the CLI operates on workspace keys automatically. SSH key management isn't supported with project tokens (RAILWAY_TOKEN); use a workspace API token or run railway login.

Known limitations

VS Code Remote-SSH isn't supported. Use railway ssh directly for shell access.

Use cases

• Debugging production issues
• Running database migrations
• Accessing language REPLs (Rails console, Django shell)
• Inspecting log files
• Troubleshooting network issues

Related

• railway connect
• railway logs