Hi Railway team,

Our production API on custom domain https://api.zenotiq.com is being rate-limited by the Railway edge (server: railway-hikari) before requests reach our Express container. The browser then reports a CORS error because the 429 response has no Access-Control-Allow-Origin header.

What’s failing

POST https://api.zenotiq.com/api/tenant/login

Origin: https://www.zenotiq.com

Content-Type: text/plain (simple request — no preflight)

Status: 429

Response headers:

server: railway-hikari

x-railway-edge: sin1

x-hikari-trace: sin1.98a6 (example)

content-type: text/plain; charset=utf-8

content-length: 12

Body: rate limited

OPTIONS preflight to the same path also returns 429 rate limited from railway-hikari (same pattern).

These responses never hit our Node/Express app, so we cannot add CORS headers or handle the login ourselves.

Impact

Login from https://www.zenotiq.com fails in production.

We temporarily avoided OPTIONS by using text/plain, but POST itself is now also 429’d by Hikari, so login is broken again.

Same issue affects our default Railway domain: https://zenotiq-backend-production.up.railway.app.

Ask

Please investigate why railway-hikari is returning 429 rate limited for legitimate browser traffic to this service/custom domain in region sin1, and either:

lift / raise the edge rate limit for this service, or

tell us what we need to change (plan limits, networking, WAF, etc.) so normal browser POSTs and OPTIONS to api.zenotiq.com reach our container.

Happy to provide more traces, timestamps, or a HAR if useful.

Thanks.