Hey there! We've found the following might help you get unblocked faster:

• 🧵 HTTP request body size

• 🧵 Webhook signature verification failed.

• 🧵 Can't use Railway Public API with Project Token (projectToken null / Not Authorized)

If you find the answer from one of these, please let us know by solving the thread!

This shouldn't be Railway. What web framework are you using?

you can't, use a POST instead of a GET

ps. POST is more secure the GET, as GET can be cached while POST not, so for sensitive thing you should use POST

I'm using node.js with Express.js framework.

What I'm doing:

I have a Zap that is timing out when using code by zapier. It has a limit of 30seconds.

I'm using Railway to host the step, so that I can just do a webhook and get the data I want.

When I build it locally, GET with Body works very fine but as soon as I deploy it on Railway, it breaks.

Have you considered using a POST or PUT for this? As fra said using GET is not correct, though it shouldn't be explicitly blocked.

Yes, POT with only the token works but I've been strictly instructed to use GET by the Dev.

Thank you for your input

Yes, that was the only thing that worked but I've been instructed by the DEV to use GET strictly.

thank you for your input!

Which developer?

I did some minimal research and found that using GET with a body is highly discouraged.

if you need to use GET you can send it only in the query string, so something like site.com?token=XXX not as json

Even better, but I suppose it depends on the API on the other side...

If Railway is stripping the body and enforcing standards, there is nothing that you can do to bypass that.
I suggest doing query params, ?token=<thetoken> or a header x-api-keyAuthorization etc.

Hey any update on this?
How are things looking.

1. Write a proxy service (in Node/Express, Python/Flask, etc.).

   • The proxy uses a raw socket or library that does allow GET+body (http.request, requests) to talk to the target API.

2. Deploy that proxy somewhere you control (Railway, Fly.io, VPS, even locally).

3. All your production traffic goes:
   Client → Proxy (safe request) → Target API (GET with body)

This way:

• Railway never blocks you (because your app just does normal requests).

• The proxy forces the weird GET+body.

• You isolate the non-standard hack to one controlled service.

That's a brilliant idea, thank you!