Browser and web containers

No built-in provider API except npm sends CORS headers. From a browser, a request to fonts.googleapis.com/css2?family=… will fail.

unifont spots that and sends provider requests through a hosted proxy instead, so the same code works with no configuration:

import { createUnifont, providers } from 'unifont'

// In a browser or a StackBlitz web container, this goes via the proxy.
const unifont = await createUnifont([providers.google()])

That covers browsers and web containers like StackBlitz, where the Node process runs in the browser and is bound by the same CORS rules. Everywhere else (a real Node server, a worker, your CI) the provider APIs are called directly and no proxy is involved.

What actually gets proxied

Only the provider API endpoints, and only the fixed list the proxy knows about. It isn't an open relay:

• Provider metadata endpoints are rewritten to go through apiBase.
• Everything else is fetched directly: npm CDNs, a custom provider's own API, the font files themselves.
• With no apiBase set and no browser detected, nothing is rewritten.

Pointing it somewhere else

const unifont = await createUnifont([providers.google()], {
  apiBase: 'https://fonts.example.com',
})

Pass false to turn it off and always call the provider APIs directly:

const unifont = await createUnifont([providers.google()], { apiBase: false })

Don't use the public proxy in production

https://proxy.unifont.dev is a convenience, and only that: it's there so reproductions, playgrounds and StackBlitz demos work without anyone deploying anything first. It's best-effort, it might be rate-limited, and it might change or disappear without warning.

The proxy is designed to be self-hosted, and running your own takes a deploy and one option. Self-hosting the proxy covers what it will and won't do, the endpoints it serves, and where to put it.

You only need any of this if you resolve fonts in a browser or a web container at runtime. If your fonts are resolved at build time (which is what @nuxt/fonts and fontless do) no proxy is involved.

Behind a corporate proxy

On the server, unifont honours HTTPS_PROXY and HTTP_PROXY (and their lower-case forms) for both metadata and font files, so builds work behind an egress proxy with no extra configuration. That's separate from apiBase. The two don't interact.