Railway

What it watches

Railway feeds Publishes — Every deploy gets a verdict within five minutes — as Publish Verification.

What Keelnest reads

Account token · read projects, services, deployments, domains and variable names.

Railway previews belong to pull requests, not branches, so a repair on Railway is verified by review.

Read-only, like every connection: Keelnest never refunds, charges, changes a price, edits a setting or an environment variable, merges on its own or runs a migration. The credential is checked with one read call before it is stored, encrypted at rest, and can be revoked at the provider at any time. Security says the whole of it.

How to connect

1. Create the account token. Railway > Account Settings > Tokens > Create token. An account token, not a project token, so every project is listed. Open Railway.
2. Paste it into Keelnest. In your workspace, open Integrations, find Railway and press Connect. Keelnest makes one read call to confirm the credential works, stores it encrypted, and starts reading on the next five-minute tick.
3. Link the apps. Under Manage, pick which applications this account watches. An app linked to a host is checked the moment that host reports a deploy; an app linked to a payment or AI account starts building its baseline from that hour.

Deploy notifications

Railway can be told to call Keelnest when a deploy finishes, so verification starts within seconds of it instead of on the five-minute poll.

Where to set it up. Railway → your project → Settings → Webhooks: paste the whole address below, everything after the `?` included. Leave it on deployment events. There is no secret field to fill in — the address already carries it.

The address and the secret to paste are shown in Keelnest under Integrations › Railway › Manage, one pair per connected account.

How a delivery is checked. The secret in the address itself (`&t=…`), compared in constant time. Railway signs nothing and sends no header you can set, so the address is the credential and is treated as one. A delivery is never trusted on its own: it says which site to look at first, and every fact about the deploy is then read back from Railway’s API, so a forged or missed delivery changes nothing the next poll would not correct.

Because Railway offers no signature and no custom header, the secret has to travel in the address. Treat that address like a password: anyone holding it can tell Keelnest a deploy happened. It is never believed on its own — every fact is still read back from Railway's API — but do not paste it into a ticket or a public repository.

Source: Railway’s documentation.

Start watching

Create a workspace and connect Railway from Integrations, or run the free check on any public URL first. All docs.