# Connecting Railway to iCompaas

- Source: https://support.icompaas.com/support/solutions/articles/onb_cloud_railway-connecting-railway-to-icompaas
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Getting Started With iCompaas](https://support.icompaas.com/support/solutions/62000037934) › [Cloud Onboarding](https://support.icompaas.com/support/solutions/folders/cloud-onboarding)
- Last updated: 2026-07-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Estimated time: 5 minutes · requires: a Railway workspace member with access to the resources you want audited

### Before you start

iCompaas audits Railway through its public GraphQL API (`backboard.railway.com/graphql/v2`) using an API token you create in the Railway dashboard. One thing to understand up front: **Railway tokens have no read-only mode**. Unlike the AWS auditor role, the Azure custom role or the GCP Viewer service account, a Railway token can do anything its scope allows — including reading environment variables in plaintext. Create the _narrowest_ token that covers what you want audited, and treat it like a production secret.

### Step 1 — Create a scoped token

1.  Open the tokens page in your Railway account settings (`railway.com/account/tokens`).
2.  In the workspace dropdown, **select the specific workspace** you want audited. This creates a _workspace token_ limited to that workspace's resources — do **not** pick _No workspace_, which creates an account-wide token covering everything you personally can touch.
3.  Name the token so its purpose is obvious (e.g. _icompaas-audit_) and create it. Copy the value — Railway shows it once.

![Railway New Token form: name the token and select your specific workspace instead of No workspace](https://support.icompaas.com/assets/kb/onb_railway_token_form.svg)

**Auditing a single project instead?** Create a _project token_ from the tokens page in that project's settings — it is scoped to one environment within one project, the tightest scope Railway offers.

### Step 2 — Save the account in iCompaas

1.  In the app, open _Onboarding → Cloud onboarding → Railway_.
2.  Enter a memorable **Cloud name** (e.g. _Prod Railway_) and paste the token.
3.  Click **Save & start scan**. Initial checks start immediately and the account appears in your Cloud Account list.

### What iCompaas evaluates

-   **Service configuration** — start/build commands, health-check paths, replica counts, restart policies and resource limits per service instance.
-   **Deployment discipline** — deployment history and statuses per environment, evidence of how changes reach production.
-   **Domains & TLS** — custom domains, DNS status and certificate state (pending / issued / failed).
-   **Volumes & backups** — volume sizes, mount paths, and backup schedules.
-   **Access posture** — workspace members and their roles (Admin / Member / Deployer) and project-level roles, so over-privileged accounts surface in your reports.
-   **Audit trail** — Railway's audit log (who did what, when). Note retention is plan-dependent on Railway's side: 48 hours on Free/Hobby, 30 days on Pro, 18 months on Enterprise.

### Good to know

-   **Rate limits:** Railway allows 100 (Free), 1,000 (Hobby) or 10,000 (Pro) API requests per hour. iCompaas paces its scans to stay inside your plan's budget; very large workspaces on small plans may scan more slowly.
-   **Rotating the token:** delete it from the Railway tokens page and add a fresh one in iCompaas — scans resume with the next run.
-   **Least privilege:** consider creating the token from a Railway user with the narrowest role that still sees the audited resources, rather than a workspace admin.

### Troubleshooting

-   **Scan sees nothing / missing projects** — the token's workspace doesn't contain them, or a project token was used where a workspace-wide audit was expected.
-   **Scans stall partway on a large workspace** — likely the hourly rate limit on Free/Hobby plans; they resume automatically.