​
Overview

The Railway integration reviews who has access to your Railway workspace — the member roster, names, and roles — via Railway’s GraphQL API. LowerPlane uses read-only access and does not read or modify your projects, services, or deployments.
Railway members are identified by email, so LowerPlane can match each member to a person in your directory for offboarding. Railway’s API does not expose per-member 2FA (Railway enforces 2FA at the workspace level, not per user), so there is no MFA check.

​
Prerequisites

You need admin access to a Railway workspace and an Account API token (which covers all workspaces the account belongs to).

​
How to Get Your Credentials

1

Open Account Tokens

In Railway, go to Account Settings → Tokens.
2

Create a token

Click Create Token, give it a name, and choose an Account token (covers all workspaces).
3

Copy the token

Copy the generated API token and store it securely.

​
Connecting in LowerPlane

  1. Go to Settings > Integrations in LowerPlane.
  2. Find Railway under Cloud Providers.
  3. Enter your API Token.
  4. Click Connect.

​
What LowerPlane Checks

User identified

Confirms each Railway member resolves to a named person, not an anonymous or shared account.

Offboarded access removed

Flags Railway access still active for an employee who has been offboarded in your HR directory.

Access valid

Verifies each member maps to a current employee in your HR directory whose access has been reviewed.