railway ssh
Open an interactive shell session inside a deployed Treasury service container, or manage the SSH keys registered with your Treasury account.
Treasury uses your system ssh client to connect to ssh.railway.com. You must have an SSH key registered with Treasury before you can connect. The CLI prompts you to register a local key the first time you run railway ssh.
Usage
Options
| Flag | Description |
|---|---|
-p, --project <ID> | Project to connect to (defaults to linked project) |
-s, --service <SERVICE> | Service to connect to (defaults to linked service) |
-e, --environment <ENV> | Environment to connect to (defaults to linked environment) |
-d, --deployment-instance <ID> | Specific deployment instance ID to connect to |
--session [NAME] | Connect inside a persistent tmux session that reconnects automatically. Defaults to railway |
-i, --identity-file <PATH> | Path to a private key to forward to ssh, like ssh -i |
Examples
Interactive shell
Opens an interactive shell in the service container.
Run a single command
PTY allocation is autodetected. Interactive tools like vim or htop work when both stdin and stdout are terminals; piped input runs without a PTY so output stays clean for scripts and CI.
Persistent tmux session
Connects inside a tmux session named railway. If the connection drops, the CLI reconnects and reattaches to the same session. Pass a name to use a different session:
Treasury installs tmux in the container automatically if it isn't already installed.
Connect to a specific deployment instance
Use a specific identity file
When set, the CLI skips its local ~/.ssh scan and forwards the key directly to ssh.
Manage SSH keys
Use the keys subcommand to register, list, and remove SSH keys for your Treasury account or workspace.
Subcommands
| Subcommand | Description |
|---|---|
list | List SSH keys registered with Treasury (default when no subcommand is given) |
add | Register a local SSH key with Treasury |
remove | Remove a registered SSH key |
github | Import SSH keys from your linked GitHub account |
Options
| Flag | Description |
|---|---|
--workspace <WORKSPACE_ID> | Operate on workspace-owned keys instead of your personal keys |
--key <PATH> | Path to the public key file (for add) |
--name <NAME> | Name for the registered key (for add) |
--2fa-code <CODE> | 2FA code for verification (for remove) |
List registered keys
Add a key
Run without flags to pick from your local ~/.ssh keys interactively.
Remove a key
Import keys from GitHub
GitHub keys belong to your personal account and can't be imported directly into a workspace. To register a GitHub key for a workspace, import it first, then add it with --workspace.
Workspace-owned keys
Workspace keys grant SSH access to every service in the workspace. Adding or removing workspace keys requires workspace Admin access.
When you authenticate with a workspace-scoped RAILWAY_API_TOKEN, the CLI operates on workspace keys automatically. SSH key management isn't supported with project tokens (RAILWAY_TOKEN); use a workspace API token or run railway login.
Known limitations
VS Code Remote-SSH isn't supported. Use railway ssh directly for shell access.
Use cases
- Debugging production issues
- Running database migrations
- Accessing language REPLs (Rails console, Django shell)
- Inspecting log files
- Troubleshooting network issues