Token Rotation and Account Security Reminder

Railway disclosed a security incident involving customer environment variables. Revoke and replace unrotated API keys stored there, and update deployments. All APIYI users should enable 2FA or a passkey, cap test-key spending, and allowlist stable public egress IPs for production keys.

2026/10/24 20:57 (UTC+8) · Service Notice

⚠️ Railway users: rotate API keys; all users: strengthen account security.

Railway disclosed possible exposure of some customers’ environment variables. If you stored credentials there and have not rotated them, revoke the old keys, create replacements, update the variables, redeploy, and review usage logs.

All APIYI users should enable 2FA or a passkey in their profile and keep recovery codes safe.

Disable unlimited quota and set a small spending cap for test keys. Keep production keys separate and allowlist your servers’ stable public egress IPs. See API key security for instructions.

2FA and passkeys protect console sign-in; exposed API keys still need to be revoked and replaced.

Official disclosure: blog.railway.com/p/security-disclosure-wednesday-october-21st. Latest updates: status.railway.com/incident/QH8L8B3E.

---

← Back to Live Updates · 📚 Archive