Sends requests via your Next.js API (no browser-to-vendor calls).
Note: private IPs/localhost are blocked.