# Browser and web containers

> Why you can't reach provider APIs from a browser, and how the proxy handles it.

No built-in provider API except `npm` sends CORS headers. From a browser, a request to `fonts.googleapis.com/css2?family=…` will fail.

`unifont` spots that and sends provider requests through a hosted proxy instead, so the same code works with no configuration:

```ts
import { createUnifont, providers } from 'unifont'

// In a browser or a StackBlitz web container, this goes via the proxy.
const unifont = await createUnifont([providers.google()])
```

That covers browsers and web containers like StackBlitz, where the Node process runs in the browser and is bound by the same CORS rules. Everywhere else (a real Node server, a worker, your CI) the provider APIs are called directly and no proxy is involved.

## What actually gets proxied

Only the provider API endpoints, and only the fixed list the proxy knows about. It isn't an open relay:

- Provider metadata endpoints are rewritten to go through `apiBase`.
- Everything else is fetched directly: npm CDNs, a custom provider's own API, the font files themselves.
- With no `apiBase` set and no browser detected, nothing is rewritten.

## Pointing it somewhere else

```ts
const unifont = await createUnifont([providers.google()], {
  apiBase: 'https://fonts.example.com',
})
```

Pass `false` to turn it off and always call the provider APIs directly:

```ts
const unifont = await createUnifont([providers.google()], { apiBase: false })
```

## Don't use the public proxy in production

`https://proxy.unifont.dev` is a convenience, and only that: it's there so reproductions, playgrounds and StackBlitz demos work without anyone deploying anything first. It's best-effort, it might be rate-limited, and it might change or disappear without warning.

The proxy is designed to be self-hosted, and running your own takes a deploy and one option. [Self-hosting the proxy](/docs/proxy) covers what it will and won't do, the endpoints it serves, and where to put it.

You only need any of this if you resolve fonts in a browser or a web container at runtime. If your fonts are resolved at build time (which is what `@nuxt/fonts` and `fontless` do) no proxy is involved.

## Behind a corporate proxy

On the server, `unifont` honours `HTTPS_PROXY` and `HTTP_PROXY` (and their lower-case forms) for both metadata and font files, so builds work behind an egress proxy with no extra configuration. That's separate from `apiBase`. The two don't interact.