weaviate · g-despot · Sep 28, 2026 · Sep 22, 2026 · Sep 22, 2026 · Sep 28, 2026
diff --git a/_includes/clients/ts-client-intro.mdx b/_includes/clients/ts-client-intro.mdx
@@ -4,6 +4,6 @@ The **v3 client** is the current TypeScript client. If you have code written for
 
 :::note
 
-The v3 client supports server side development (Node.js hosted). If your application is browser based, you might consider using the [TypeScript client v2](/weaviate/client-libraries/typescript#javascripttypescript-client-v2-deprecation). Keep in mind that the v2 client is outdated and no longer officially maintained.
+The v3 client runs on the server (Node.js hosted). For browsers and edge runtimes, use the [web client](/weaviate/client-libraries/typescript/web-client), which is currently an alpha.
 
 :::
diff --git a/docs/deploy/configuration/env-vars/index.md b/docs/deploy/configuration/env-vars/index.md
@@ -52,7 +52,7 @@ import APITable from '@site/src/components/APITable';
 | `ENABLE_TOKENIZER_GSE` | Enable the [`GSE` tokenizer](/weaviate/config-refs/collections.mdx) for use | `boolean` | `true` |
 | `ENABLE_TOKENIZER_KAGOME_JA` | Enable the [`Kagome` tokenizer for Japanese](/weaviate/config-refs/collections.mdx) for use | `boolean` | `true` |
 | `ENABLE_TOKENIZER_KAGOME_KR` | Enable the [`Kagome` tokenizer for Korean](/weaviate/config-refs/collections.mdx) for use | `boolean` | `true` |
-| `EXPERIMENTAL_REST_SEARCH_ENABLED` | (EXPERIMENTAL) Enable the [REST Search API](/weaviate/api/rest): the `POST /v1/search/{collection}/near-text`, `/bm25`, `/hybrid` and `/near-object` endpoints, and the sibling `POST /v1/aggregate/{collection}` endpoint. While disabled, these endpoints reject requests with a `422` status. Default: `false` | `boolean` | `true` |
+| `EXPERIMENTAL_REST_SEARCH_ENABLED` | **Removed in `v1.39.7`.** The [REST Search API](/weaviate/api/rest) is enabled by default from `v1.39.7`, so no variable is needed. In `v1.39.0` through `v1.39.6`: enabled the `POST /v1/search/{collection}/near-text`, `/bm25`, `/hybrid` and `/near-object` endpoints, and the sibling `POST /v1/aggregate/{collection}` endpoint. While disabled, those endpoints rejected requests with a `422` status. Default was `false`. <br/>Added in `v1.39.0` | `boolean` | `true` |
 | `EXPORT_DEFAULT_BUCKET` | Storage bucket name for [collection exports](/docs/deploy/configuration/export.md). Required for S3, GCS, and Azure backends.<br/>Added in `v1.37` | `string` | `my-export-bucket` |
 | `EXPORT_DEFAULT_PATH` | Optional base path prefix for exported files within the bucket for [collection exports](/docs/deploy/configuration/export.md). Defaults to `""` (no prefix). _Changed in `v1.37.1`: previously required to be explicitly set._<br/>Added in `v1.37` | `string` | `exports/my-cluster` |
 | `EXPORT_ENABLED` | Enable the [collection export](/docs/deploy/configuration/export.md) API. Default: `false`<br/>Added in `v1.37` | `boolean` | `true` |

diff --git a/docs/weaviate/api/graphql/migration.mdx b/docs/weaviate/api/graphql/migration.mdx
diff --git a/docs/weaviate/api/grpc.md b/docs/weaviate/api/grpc.md
@@ -64,7 +64,7 @@ The gRPC-Web interface is enabled by default. **[Runtime configuration](/deploy/
 
 This setting has no environment variable equivalent. When the interface is disabled, requests to `/v1/grpc-web/` fall through to the REST handler, so other REST endpoints keep working as usual.
 
-The Weaviate client libraries connect over plain gRPC, so they do not use the gRPC-Web interface yet.
+The TypeScript [web client](../client-libraries/typescript/web-client.mdx) connects through gRPC-Web. The other client libraries connect over plain gRPC.
 
 ## Questions and feedback
 

diff --git a/docs/weaviate/api/index.mdx b/docs/weaviate/api/index.mdx
@@ -11,7 +11,7 @@ Weaviate provides multiple Application Programming Interfaces (APIs) to interact
 
   - Includes operations for managing collections (creating, reading, updating, deleting collections and their definitions), performing basic CRUD (Create, Read, Update, Delete) operations on individual data objects, checking node status, backups, and managing cluster health.
   - The machine-readable specification behind this reference is published at <SkipValidationLink href="/openapi.json">`https://docs.weaviate.io/openapi.json`</SkipValidationLink>. See [Machine-readable API specification](#machine-readable-api-specification) below.
-  - The reference also lists an experimental REST Search API (the `/v1/search/{collection}/...` and `/v1/aggregate/{collection}` endpoints), which is disabled by default and rejects requests with a `422` status until [`EXPERIMENTAL_REST_SEARCH_ENABLED`](/deploy/configuration/env-vars/index.md#EXPERIMENTAL_REST_SEARCH_ENABLED) is set to `true`.
+  - The reference also lists an experimental REST Search API (the `/v1/search/{collection}/...` and `/v1/aggregate/{collection}` endpoints), which is enabled by default from `v1.39.7`. In `v1.39.0` through `v1.39.6` it is disabled unless [`EXPERIMENTAL_REST_SEARCH_ENABLED`](/deploy/configuration/env-vars/index.md#EXPERIMENTAL_REST_SEARCH_ENABLED) is set to `true`, and rejects requests with a `422` status.
 
 - **[Search API - GraphQL](./graphql/index.md)**: Designed specifically for data querying and exploration.
 

diff --git a/docs/weaviate/client-libraries/typescript/index.mdx b/docs/weaviate/client-libraries/typescript/index.mdx
@@ -125,6 +125,12 @@ All client v3 methods, with the exception of `collection.use()`, use ES6 Promise
 
 When there is an asynchronous code error, a promise returns the specific error message. If you use `async` and `await`, a rejected promises acts like a thrown exception
 
+## Web client (`@weaviate/web`)
+
+`@weaviate/web` is a browser build of the v3 client, for browsers and edge runtimes where a plain gRPC connection is not possible. It has the same API and talks to Weaviate over gRPC-Web on the HTTPS port. It is an alpha.
+
+For install steps and browser notes, see [Web client](./web-client.mdx).
+
 ## Releases
 
 Go to the [GitHub releases page](https://github.com/weaviate/typescript-client/releases) to see the history of the TypeScript client library releases and change logs.

diff --git a/docs/weaviate/client-libraries/typescript/web-client.mdx b/docs/weaviate/client-libraries/typescript/web-client.mdx
@@ -0,0 +1,65 @@
+---
+title: Web client
+sidebar_position: 3
+description: "The @weaviate/web package: a browser build of the Weaviate v3 TypeScript client that connects over gRPC-Web."
+image: og/docs/client-libraries.jpg
+---
+
+{/* MAINTENANCE: `3.15.0-alpha.6` is hardcoded in 3 places: the Alpha admonition and the
+    install command below, plus the availability table in weaviate/api/graphql/migration.mdx.
+    The `latest` tag lags behind, so the admonition also names the version it points at.
+    Update all 3 together when the package moves. */}
+
+`@weaviate/web` is a browser build of the v3 client. Use it in browsers and edge runtimes such as Cloudflare Workers and Vercel, where a plain gRPC connection is not possible.
+
+It has the same API as `weaviate-client`, but sends queries over gRPC-Web. Connect options take one HTTP(S) endpoint. There is no gRPC host or port to set, because Weaviate serves gRPC-Web on the REST port.
+
+:::caution Alpha
+
+`@weaviate/web` `3.15.0-alpha.6` is an alpha. The `latest` tag still points at `3.15.0-alpha.2`, an older alpha that fails to load, so always install the version explicitly.
+
+:::
+
+## Install
+
+Install the alpha explicitly:
+
+```bash
+npm install @weaviate/web@3.15.0-alpha.6
+```
+
+The `latest` tag still points at an older alpha that fails to load, so name the version.
+
+The package is ESM-only.
+
+## Connect to Weaviate
+
+Use a `connectTo*` helper. The low-level `weaviate.client(params)` entry point does not add the `/v1/grpc-web` prefix. `grpcHost`, `grpcPort` and `grpcSecure` are not connect options. If you pass them, they are ignored.
+
+:::info Added in `v1.38.3`
+Weaviate serves gRPC-Web by default from `v1.38.3`. 
+:::
+
+So the web client needs Weaviate `v1.38.3` or later. On `v1.38.2` it fails to connect, and the error names the missing path:
+
+```text
+/grpc.health.v1.Health/Check UNIMPLEMENTED: Received HTTP 404 response:
+{"code":404,"message":"path /v1/grpc-web/grpc.health.v1.Health/Check was not found"}
+```
+
+For the server side, see [gRPC-Web](../../api/grpc.md#grpc-web).
+
+
+## Browser notes
+
+**Provider API keys work in the browser. Other custom headers do not.** Model provider keys passed through `headers`, such as `X-OpenAI-Api-Key`, are on Weaviate's default CORS allow-list, so they work cross-origin out of the box. Any other header fails the browser's CORS preflight unless the operator lists it in [`CORS_ALLOW_HEADERS`](/deploy/configuration/env-vars/index.md#CORS_ALLOW_HEADERS) on the server. Setting that variable replaces the default list, so include the defaults you still need. Node runs no preflight, so test header behavior in a real browser.
+
+:::warning Browser credentials are visible to the user
+Anyone who loads your page can read whatever the bundle holds, including Weaviate and model provider API keys. Use a read-only API key with the least [RBAC](/deploy/configuration/authorization.md) permissions the app needs. Never ship an admin key to a browser.
+:::
+
+## Questions and feedback
+
+import DocsFeedback from "/_includes/docs-feedback.mdx";
+
+<DocsFeedback />
diff --git a/sidebars.js b/sidebars.js
@@ -822,6 +822,7 @@ const sidebars = {
             id: "weaviate/client-libraries/typescript/index",
           },
           items: [
+            "weaviate/client-libraries/typescript/web-client",
             "weaviate/client-libraries/typescript/notes-best-practices",
             {
               type: "link",

diff --git a/src/theme/ContentVisibility/Unlisted/index.js b/src/theme/ContentVisibility/Unlisted/index.js
@@ -0,0 +1,21 @@
+import React from "react";
+import { UnlistedMetadata } from "@docusaurus/theme-common";
+
+/**
+ * Swizzled from @docusaurus/theme-classic.
+ *
+ * The upstream component renders two things for an `unlisted: true` page:
+ * <UnlistedMetadata /> (the `noindex, nofollow` robots meta) and a caution
+ * banner reading "This page is unlisted."
+ *
+ * We keep the metadata and drop the banner. Unlisted pages in this repo are
+ * finished, hand-distributed pages rather than drafts, so the banner would tell
+ * a reader who was given the link that the page is provisional. The metadata is
+ * load-bearing and must stay: besides the robots meta itself, the sitemap
+ * plugin decides what to exclude by reading the emitted `noindex` meta
+ * (@docusaurus/plugin-sitemap `isNoIndexMetaRoute`), so removing it would put
+ * unlisted pages back into sitemap.xml.
+ */
+export default function Unlisted() {
+  return <UnlistedMetadata />;
+}
-Original file line number
+Diff line change
@@ Expand Up @@
     :::note
-    The v3 client supports server side development (Node.js hosted). If your application is browser based, you might consider using the [TypeScript client v2](/weaviate/client-libraries/typescript#javascripttypescript-client-v2-deprecation). Keep in mind that the v2 client is outdated and no longer officially maintained.
+    The v3 client runs on the server (Node.js hosted). For browsers and edge runtimes, use the [web client](/weaviate/client-libraries/typescript/web-client), which is currently an alpha.
     :::