# CDN

CDN is optional, off by default, and included with an active paid app plan. It speeds up public assets by caching them close to visitors. It is separate from private Launchbase Files storage and does not make private files public.

Read settings with MCP `get_cdn {appId}` or `GET /api/v1/apps/{appId}/cdn`. Enable/disable using `configure_cdn {appId, enabled}` or `PUT /api/v1/apps/{appId}/cdn` with `{"enabled":true}`. Deploy hosting and activate a paid app plan first. Turning on CDN does not purchase or upgrade a plan.

Launchbase configures HTML caching to never, a 30-minute fallback TTL for assets, automatic clearing after successful deployments, and no stale-while-revalidate. The app's explicit cache headers can override asset freshness. Use versioned asset names. Clear the whole cache using `purge_cdn {appId}` or `POST /api/v1/apps/{appId}/cdn/purge` after out-of-deployment content changes.

## Required app behaviour

- Cache only public, non-personalised content. Bundled CSS, JavaScript, fonts and public images are good candidates.
- Send `Cache-Control: private, no-store` on authenticated API responses, account pages, signed download responses and anything specific to a user. Do not rely on cookies: cookies alone neither bypass Railway's cache nor separate cached entries.
- Railway skips requests with Authorization and responses with Set-Cookie, private/no-store, or Vary: Cookie. Still set explicit private/no-store headers rather than depending on an incidental cookie.
- Static content types can cache even without a Cache-Control header. A private image served by the app therefore needs private/no-store too.
- HTML is never cached by this Launchbase integration. JSON may cache if you explicitly give it freshness headers, so never mark private JSON public.
- Verify a public asset reaches x-cache: HIT and private responses never do. Test with two users. CDN is not a firewall or a substitute for authentication.

CDN is disabled before app hosting suspension and restored when eligible hosting resumes. New deployments clear the provider cache. Already downloaded browser copies cannot be revoked. Provider changes and purges can take time to propagate.

Railway's CDN is currently beta. Source: https://docs.railway.com/networking/cdn