---
title: "Web client"
description: "The @weaviate/web package: a browser build of the Weaviate v3 TypeScript client that connects over gRPC-Web."
url: https://docs.weaviate.io/weaviate/client-libraries/typescript/web-client
---

# Web client

`@weaviate/web` is a browser build of the v3 client. Use it in browsers and edge runtimes such as Cloudflare Workers and Vercel, where a plain gRPC connection is not possible.

It has the same API as `@weaviate/node`, but sends queries over gRPC-Web. Connect options take one HTTP(S) endpoint. There is no gRPC host or port to set, because Weaviate serves gRPC-Web on the REST port.

## Install

```bash
npm install @weaviate/web
```

The package is ESM-only.

## Connect to Weaviate

Use a `connectTo*` helper. The low-level `weaviate.client(params)` entry point does not add the `/v1/grpc-web` prefix. `grpcHost`, `grpcPort` and `grpcSecure` are not connect options. If you pass them, they are ignored.

> [!NOTE]
>
> **Added in `v1.38.3`**
>
> Weaviate serves gRPC-Web by default from `v1.38.3`.

The web client needs Weaviate `v1.38.3` or later. On `v1.38.2` it fails to connect, and the error names the missing path:

```text
/grpc.health.v1.Health/Check UNIMPLEMENTED: Received HTTP 404 response:
{"code":404,"message":"path /v1/grpc-web/grpc.health.v1.Health/Check was not found"}
```

For the server side, see [gRPC-Web](https://docs.weaviate.io/weaviate/api/grpc#grpc-web).

## Browser notes

**Server-side batching is not available.** These calls throw in the web client:

```ts
client.batch.stream()
collection.data.ingest()
```

**Provider API keys work in the browser. Other custom headers do not.** Model provider keys passed through `headers`, such as `X-OpenAI-Api-Key`, are on Weaviate's default CORS allow-list, so they work cross-origin out of the box. Any other header fails the browser's CORS preflight unless the operator lists it in [`CORS_ALLOW_HEADERS`](https://docs.weaviate.io/deploy/configuration/env-vars#CORS_ALLOW_HEADERS) on the server. Setting that variable replaces the default list, so include the defaults you still need. Node runs no preflight, so test header behavior in a real browser.

> [!WARNING]
>
> **Browser credentials are visible to the user**
>
> Anyone who loads your page can read whatever the bundle holds, including Weaviate and model provider API keys. Use a read-only API key with the least [RBAC](https://docs.weaviate.io/deploy/configuration/authorization) permissions the app needs. Never ship an admin key to a browser.