Web client
@weaviate/web is a browser build of the v3 client. Use it in browsers and edge runtimes such as Cloudflare Workers and Vercel, where a plain gRPC connection is not possible.
It has the same API as @weaviate/node, but sends queries over gRPC-Web. Connect options take one HTTP(S) endpoint. There is no gRPC host or port to set, because Weaviate serves gRPC-Web on the REST port.
Install
npm install @weaviate/web
The package is ESM-only.
Connect to Weaviate
Use a connectTo* helper. The low-level weaviate.client(params) entry point does not add the /v1/grpc-web prefix. grpcHost, grpcPort and grpcSecure are not connect options. If you pass them, they are ignored.
v1.38.3Weaviate serves gRPC-Web by default from v1.38.3.
The web client needs Weaviate v1.38.3 or later. On v1.38.2 it fails to connect, and the error names the missing path:
/grpc.health.v1.Health/Check UNIMPLEMENTED: Received HTTP 404 response:
{"code":404,"message":"path /v1/grpc-web/grpc.health.v1.Health/Check was not found"}
For the server side, see gRPC-Web.
Browser notes
Server-side batching is not available. These calls throw in the web client:
client.batch.stream()
collection.data.ingest()
Provider API keys work in the browser. Other custom headers do not. Model provider keys passed through headers, such as X-OpenAI-Api-Key, are on Weaviate's default CORS allow-list, so they work cross-origin out of the box. Any other header fails the browser's CORS preflight unless the operator lists it in CORS_ALLOW_HEADERS on the server. Setting that variable replaces the default list, so include the defaults you still need. Node runs no preflight, so test header behavior in a real browser.
Anyone who loads your page can read whatever the bundle holds, including Weaviate and model provider API keys. Use a read-only API key with the least RBAC permissions the app needs. Never ship an admin key to a browser.
Questions and feedback
Have a question or feedback? Here's how to reach us.
