Railway API Token Not Working? Fix "Not Authorized" and "Project Token not found" (Oct 2026)

Disclosure: this article was drafted with the help of an AI writing assistant. The token types, headers and error messages were checked against Railway's docs and live API on 23 Oct 2026. Originally published in Stackademic on Medium.

Railway invalidated every API token and Project Token created before its October 2026 security incident. Here is how to create the right new token, test it, and fix your CLI and CI.

Last updated: 24 Oct 2026, 1:50 PM IST. Times are in IST (UTC+5:30).

Quick answer: If your Railway API token, Project Token or CLI token stopped working on or after 21 Oct 2026, it is almost certainly because Railway invalidated every token created before its security incident. Railway's status page says those tokens "remain invalidated", so the only fix is to create a new token of the right type and update every place that used the old one. Regenerating is not optional, and no setting brings an old token back.

TL;DR

Old tokens are dead on purpose. Railway confirmed this on 22 Oct at 10:30 PM IST (17:00 UTC), when it declared its API fully restored.
Pick the right type: account token (everything you can access), workspace token (one workspace) or project token (one environment in one project).
Account and workspace tokens use the "Authorization: Bearer" header. Project tokens use the "Project-Access-Token" header. Mixing them up causes errors.
For the CLI, a project token goes in RAILWAY_TOKEN, and an account or workspace token goes in RAILWAY_API_TOKEN.
Update GitHub Actions secrets, CI variables, scripts and local shells. Then test.

Why did my Railway API token stop working?

On 21 Oct 2026, Railway published a security disclosure. It said an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. As part of the response, Railway invalidated all API tokens.

On 22 Oct at 10:30 PM IST, Railway's status page said the API was fully restored, with an important note: "API tokens and Project Tokens created before the security incident remain invalidated, so if you use the Public API or the cli with a token, please create a new token."

So if your token is older than the incident, nothing is wrong with your code. The token itself no longer works.

If you want the full incident timeline, I covered it in Is Railway down? What the 21–22 October 2026 Railway outage means for developers.

Which Railway token do you need?

Railway's Public API docs list these token types:

Account token: access to all your resources and workspaces. Railway suggests it for personal scripts and local development. It is the broadest scope, so don't share it.
Workspace token: access to a single workspace. Railway suggests it for team CI/CD and shared automation.
Project token: access to a single environment in one project. Railway suggests it for deployments and service-specific automation.
OAuth access token: for apps that act on behalf of other Railway users through "Login with Railway".

My rule of thumb as a Laravel and Node developer: give each job the smallest token that works. A GitHub Actions job that only runs a deploy needs a project token, not your account token.

How to create a new Railway account or workspace token

Sign in to Railway and open the tokens page in your account settings.
Create a new token.
In the workspace dropdown, choose "No workspace" for an account token, or pick one workspace for a workspace token.
Copy the token straight into your password manager or CI secret store. Treat it like a password.

How to create a new Railway project token

Open the project in Railway.
Go to the project settings and open the tokens page.
Create a token for the environment you need (for example, production).
Copy it into your CI secret store.

A project token only works for the one environment it was created for. If you deploy to staging and production, you need one token per environment.

How to test your new Railway token with curl

The Railway API endpoint is https://backboard.railway.com/graphql/v2. These test queries come from Railway's docs.

Account token (returns your name and email):

curl --request POST \ --url https://backboard.railway.com/graphql/v2 \ --header 'Authorization: Bearer YOUR_ACCOUNT_TOKEN' \ --header 'Content-Type: application/json' \ --data '{"query":"query { me { name email } }"}'

Project token (returns the project and environment IDs). Note the different header:

curl --request POST \ --url https://backboard.railway.com/graphql/v2 \ --header 'Project-Access-Token: YOUR_PROJECT_TOKEN' \ --header 'Content-Type: application/json' \ --data '{"query":"query { projectToken { projectId environmentId } }"}'

A workspace token can't run the "me" query, because that data belongs to your personal account. Railway's docs give a separate workspace query that needs your workspace ID.

What the errors look like

I sent both test queries with a deliberately invalid token on 23 Oct 2026. In both cases the API returned HTTP 200, not 401, with an error inside the JSON:

With a bad Bearer token, the "me" query returned the message "Not Authorized".
With a bad Project-Access-Token, the "projectToken" query returned the message "Project Token not found".

Both errors carried the code INTERNAL_SERVER_ERROR, which is how Railway's docs say authorization failures are reported. So don't rely on the HTTP status code alone. Read the errors array. If you see either message with a token you created before 21 Oct, create a new one.

How to fix Railway CLI token errors

Railway's CLI docs say:

Put a project token in RAILWAY_TOKEN for project-level actions, such as railway up, railway redeploy and railway logs.
Put an account or workspace token in RAILWAY_API_TOKEN for account-level actions.

Here is a CI-style deploy with a project token, in the form Railway's docs show:

RAILWAY_TOKEN=your-new-project-token railway up

On my machine (Railway CLI 5.71.0, 23 Oct 2026), an invalid token gave these messages:

With RAILWAY_TOKEN: "Unauthorized. Please check that your RAILWAY_TOKEN is valid and has access to the resource you're trying to use."
With RAILWAY_API_TOKEN: "Unauthorized. Please check that your RAILWAY_API_TOKEN is valid and has access to the resource you're trying to use."
With no token and no login: "Unauthorized. Please login with railway login"

If you work interactively on your own laptop, you don't need a token at all. Run railway login, or railway login --browserless on a remote server, then run railway whoami to confirm.

How to update GitHub Actions and other CI secrets

In GitHub, open the repository, then Settings, then Secrets and variables, then Actions.
Edit the existing secret (for example RAILWAY_TOKEN or RAILWAY_API_TOKEN) and paste the new value. Keep the same name so your workflow file doesn't need to change.
Re-run the last failed workflow.

Railway's own PR-environment example reads RAILWAY_API_TOKEN from a GitHub secret. Its docs add a note: if you use a workspace project, make sure the token is scoped to your account, not a specific workspace. Do the same in GitLab CI, Bitbucket, Jenkins or any cron server that calls Railway.

Also check these places, which people often forget:

A .env file on your laptop or a teammate's laptop.
Shell profiles such as .bashrc or .zshrc that export RAILWAY_TOKEN.
Scripts that call the GraphQL API from another server.
Third-party dashboards or bots that you gave a Railway token.

Common mistakes that look like a broken token

Using Bearer with a project token. Project tokens need the Project-Access-Token header.
Running "me" with a workspace or project token. That query only works with an account token.
Using a project token for the wrong environment. It only works for the environment it was created for.
Hitting the rate limit. Railway's docs list 100 requests per hour on Free, 1,000 on Hobby and 10,000 on Pro, plus 10 requests per second on Hobby and 50 on Pro. Over the limit you get HTTP 429. Wait for the Retry-After interval.
Swapping the CLI variables. A project token in RAILWAY_API_TOKEN, or an account token in RAILWAY_TOKEN, fails.

Token hygiene after the incident

One token per job, with the smallest scope that works.
Store tokens only in a secret manager or CI secrets, never in Git.
Don't paste tokens into chats, tickets or screenshots.
The Railway CLI itself warns that railway run env and railway run printenv can print secret values. Don't share that output.
Delete tokens you no longer use.

New tokens fix access, but they don't fix leaked app secrets. Railway still recommends rotating every environment variable you stored there. Its engineering blog has step-by-step guides for databases, GitHub, AWS, GCP, Stripe and AI provider keys.

FAQ

Why is my Railway API token not working?
Railway invalidated all API tokens and Project Tokens created before its October 2026 security incident. Create a new token and replace the old one everywhere.

Why do I get "Project Token not found" on Railway?
The project token is invalid, deleted, or older than the incident. It also happens if you send a project token through the wrong header. Create a new project token and send it in the Project-Access-Token header.

How do I get a Railway API token?
Account and workspace tokens are created on the tokens page in your account settings (railway.com/account/tokens). Project tokens are created on the tokens page in your project settings.

What's the difference between RAILWAY_TOKEN and RAILWAY_API_TOKEN?
RAILWAY_TOKEN holds a project token for project-level actions such as deploys. RAILWAY_API_TOKEN holds an account or workspace token for account-level actions.

Will my old Railway tokens start working again?
Railway says pre-incident API tokens and Project Tokens remain invalidated. Plan on replacing them, not waiting.

Do I need a token to use the Railway CLI on my laptop?
No. Run railway login for an interactive session. Railway revoked CLI sessions during the incident, so if the CLI says you're not authorized, run railway logout and then railway login (Railway guide). Tokens are for CI and automation.

Is the Railway API back up?
Railway said the API was fully restored on 22 Oct 2026 at 10:30 PM IST. Railway published its preliminary incident report at 10:08 PM IST on 23 Oct and marked the incident resolved at 3:36 AM IST on 24 Oct, but new signups are still paused. Old API tokens and Project Tokens remain invalid. Check status.railway.com for the current state.