Skip to main content
Every response from img.logo.dev carries Access-Control-Allow-Origin: *. With crossorigin="anonymous" set, canvas calls such as toDataURL() work without a proxy. For OG images and PDFs that you render on the server, get the file from the Logo.dev API, and CORS does not apply.

Draw a logo on a canvas

A cross-origin image taints a <canvas>. On a tainted canvas, toDataURL() and getImageData() throw a SecurityError. Set crossorigin="anonymous" so the browser makes a CORS request and the canvas stays clean:
In script, set crossOrigin before src:

Allow img.logo.dev in your Content Security Policy

If your app sets a Content-Security-Policy, the browser blocks any image whose origin isn’t in img-src. The image fires its error event, as a broken link does, and the console shows a CSP violation. Add img.logo.dev to img-src:
Your server calls the API with a secret key, not the browser. The API does not need a connect-src entry.

Generate OG images and PDFs on the server

Open Graph images (Satori, @vercel/og), PDF and screenshot rendering (Puppeteer, Playwright), and image processing (sharp) need the logo file on your server. Get the file from the API, not the CDN. GET /v2/brands/logo returns a download URL for the file. Store the file, and pass its bytes to the renderer. See self-hosting for the code.

Use Logo.dev with Next.js

Render next/image with unoptimized so the browser loads each logo.