docs: document Railway CLI tokens in .env.example#956
Merged
Conversation
Records the two Railway CLI credentials and where they belong, so remote agents and CI can authenticate without an interactive browser login. Both keys ship commented out — neither the Next.js app nor the worker reads them (src/lib/env.ts never references either), so this changes no runtime behaviour. - RAILWAY_TOKEN: project token, scoped to one project + environment. Preferred for CI; narrowest blast radius. - RAILWAY_API_TOKEN: account/workspace token, spans all projects. Required for account-level actions (railway list/link, GraphQL Public API). Also notes why ~/.railway/config.json must not be copied or committed: it holds a ~1h OAuth session plus absolute local worktree paths, so it is not portable. Points at the AGENTS.md provider-confirmation boundary and docs/worker-deploy-runbook.md, since deploys remain operator-confirmed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds Railway deployment credential documentation to ChangesRailway credential documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.env.example:
- Around line 185-215: Remove .env.example from the repository and relocate the
Railway credential placeholders and usage guidance to tracked documentation,
preserving the existing security and deployment instructions. Update repository
ignore/configuration rules as needed so .env.example and other prohibited .env.*
files are not intentionally retained or committed.
- Around line 197-204: Update the Railway token documentation comments to point
project-token creation to Project Settings > Tokens instead of Account Settings.
In the RAILWAY_API_TOKEN description, accurately distinguish account/workspace
scope, state that workspace tokens are limited to one workspace, and clarify
that project-scoped requests use the Project-Access-Token mechanism.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 77ab0d7e-e0ff-4de3-9f29-e8d687c1ed46
📒 Files selected for processing (1)
.env.example
Addresses CodeRabbit review on #956. The original block sent readers to Account Settings for both tokens, which is wrong for the project token. Verified against Railway's Public API docs (/integrations/api): - Project token is created in Project Settings -> Tokens, scoped to one environment in one project. - Account and workspace tokens are created at railway.com/account/tokens; selecting a workspace scopes it, "No workspace" gives full account scope. These are two distinct types, not one. - Note that only one of RAILWAY_TOKEN / RAILWAY_API_TOKEN should be set. - Note the differing GraphQL headers (Project-Access-Token vs Authorization: Bearer) for direct API use. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…/BigSimmo/Database into claude/railway-token-docs-638ad6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the two Railway CLI credentials in
.env.exampleso remote agents and CI can authenticate without an interactive browser login. Affected area:.env.exampleonly — documentation, no runtime surface.RAILWAY_TOKENRAILWAY_API_TOKENrailway list/link, GraphQL Public API)Semantics were verified against Railway's CLI documentation rather than assumed.
Motivation: nothing in the repo recorded how Railway auth works for non-interactive use. The only local credential is
~/.railway/config.json, which holds a ~1h OAuth session plus absolute local worktree paths — not portable, and unsafe to copy or commit. This documents the correct path (mint a scoped token, store it in a secret store) instead.Both keys ship commented out. Neither the Next.js app nor the worker reads them —
src/lib/env.tsreferences neither — so runtime behaviour is unchanged.Verification
Verification not run: this worktree has no
node_modules, so the fullnpm run verify:pr-localgate could not execute locally. CI is the authority on the remaining checks. What was confirmed locally:check:runtime— pass (Node 24.18.0, npm 11.17.0)prettier --check --ignore-unknown -- .env.example); prettier has no parser for.envfiles and skips it via--ignore-unknown.env.examplesyntax — every non-comment line is a validKEY=VALUERAILWAY*keys (both commented); diff scanned for secret-shaped strings, none found.env.examplekeys —scripts/production-readiness.tsonly asserts the file exists, so an unread key cannot break a checkRisk and rollout
git revertthe single commit — no migration, state, or config to unwind.🤖 Generated with Claude Code
Summary by CodeRabbit
RAILWAY_TOKENandRAILWAY_API_TOKEN.