Roughly half of web-hosted NFT metadata cannot be read by a web page, because the hosts never send one CORS header. This service makes it readable: name a token, and the metadata its blockchain points to comes back with access-control-allow-origin: *.
It is not a general proxy. It never fetches a URL you choose; it fetches the URL the chain returns for the token you name, and it only serves JSON. There is nothing here to relay, scrape through, or hide behind.
GET /v1/meta/{chain}/{contract}/{tokenId}
GET /url?u={a metadata URL this service has already resolved}
Example: /v1/meta/ethereum/0xBC4CA0EdA7647A8aB7C2061c2E118A18a936f13D/0
Responses carry x-token-uri (what the chain returned), x-cache, and, when a host is down and a cached copy is served, x-stale: 1.
/v1/domains lists every metadata host this service has fetched from. Cached copies expire: content-addressed documents after 30 days, plain URLs after 6 hours.
This proxy sees which tokens are looked up, like any server sees its requests. Problems: @intangible_eth.
You can make this proxy unnecessary for your collection. Add one response header to your metadata endpoints:
access-control-allow-origin: *
That is the whole fix. Your metadata is already public and already served to every wallet and script that asks; the header only lets web pages read the same reply. The wildcard never exposes credentials or cookies, because browsers refuse to send credentials with it. In nginx it is add_header Access-Control-Allow-Origin *;, in Express res.set('Access-Control-Allow-Origin', '*'), on S3 or CloudFront a CORS policy with AllowedOrigins: ["*"], behind Cloudflare a Response Header Transform Rule. Once it is live, pages read you directly and your tokens stop needing a middleman.