This is most likely an issue with your middleware, where unauthenticated users are being redirected too many times in a cycle, and I assume you are authenticated on your local setup, that's why you don't see this error. If you can provide your middleware code, I can help you fix it.

This looks like a middleware auth-check issue rather than a Railway routing problem — the signature (/api/health returns 200 fine, but every HTML route including /login itself redirects to /login) is the classic infinite-redirect pattern from an auth middleware.ts whose condition is either matching /login when it shouldn't, or never seeing a valid session in production.

Two things worth checking:

Your middleware matcher — if it's something like matcher: ['/((?!api|_next/static|favicon.ico).*)'], that still catches /login, so the auth check runs there too and loops forever. /login needs to be explicitly excluded.

If you're using NextAuth/Auth.js: check that NEXTAUTH_URL (or AUTH_URL in v5) and AUTH_TRUST_HOST=true are set as env vars on Railway, matching your exact public domain. Locally this defaults to localhost and works fine; in production behind Railway's proxy, a missing/mismatched URL can make session/cookie validation silently fail on every request — so the app thinks you're always logged out, even on /login.

Works locally + fails only in production + hits every route is a strong signal it's env-config, not code.