One URL in.
The right logos out.

You need Node.js 22 or newer, npm, and internet access to inspect public websites. No database or API key is required.

$ git clone https://github.com/Hendrikc4/logo-yoink.git
$ cd logo-yoink
$ npm ci
$ npx playwright install chromium
$ cp .env.example .env.local
$ npm start

Verify your setup

npm run smoke starts an isolated local server, verifies the homepage and API validation, then shuts it down. It does not contact a third-party site. For the full suite, run npm run check.

Send JSON to the endpoint on the instance you control. The hosted endpoint powers the public demo and is intentionally rate-limited.

$ curl -sS http://127.0.0.1:4310/api/extract \
  -H 'content-type: application/json' \
  -d '{"website":"stripe.com"}'

const response = await fetch('http://127.0.0.1:4310/api/extract', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ website: 'stripe.com' }),
});

if (!response.ok) throw new Error(`Extraction failed: ${response.status}`);
const { assets, assetVariants } = await response.json();

console.log(assets.icon?.resolvedUrl);
console.log(assets.logo?.resolvedUrl);

Discovers, validates, deduplicates, and ranks logo assets for one public HTTP or HTTPS website.

Request body

Icon and logo preferences use the same fields. Omitted values normalize to any.

{
  "website": "stripe.com",
  "preferences": {
    "icon": { "color": "color" },
    "logo": {
      "theme": "dark",
      "color": "white",
      "background": "transparent"
    }
  }
}

Preferences are best-effort. A matching eligible asset ranks first when available; otherwise Logo Yoink returns the strongest eligible fallback.

Representative response

{
  "input": "stripe.com",
  "domain": "stripe.com",
  "homepage": "https://stripe.com/",
  "preferences": {
    "icon": { "theme": "any", "color": "any", "background": "any" },
    "logo": { "theme": "dark", "color": "white", "background": "transparent" }
  },
  "assets": {
    "icon": null,
    "logo": {
      "resolvedUrl": "https://…/logo.svg",
      "dataUrl": "data:image/svg+xml;base64,…",
      "format": "svg",
      "width": 512,
      "height": 170,
      "source": "dom-img",
      "variant": { "theme": "dark", "color": "white", "background": "transparent" },
      "role_scores": { "icon": 28, "wide": 84, "favicon": 12 },
      "predicted_roles": ["wide"],
      "score_reasons": ["wide shape +30", "home linked +12"]
    }
  },
  "assetVariants": {
    "icon": [],
    "logo": [{
      "resolvedUrl": "https://…/logo.svg",
      "certainty": { "score": 84, "band": "high" }
    }]
  },
  "variantPolicy": { "minimumRoleScore": 45 },
  "assetFamilies": [],
  "candidates": [],
  "diagnostics": { "discovered": 19, "validated": 8, "browserUsed": false, "durationMs": 1240 }
}

Successful responses expose RateLimit-Limit and RateLimit-Remaining. Errors use the stable shape { "error": "Human-readable message." }.

Logo Yoink loads .env.local automatically. Keep secrets there; it is gitignored. The checked-in .env.example contains safe local defaults.

The repository includes a Vercel function adapter and static configuration. The same app can run as a long-lived Node process with npm start.

No model is called during extraction. AI-assisted review was used offline to label benchmark candidates and evaluate changes; the live ranker is an interpretable ruleset.

The ranker deliberately abstains when evidence is weak. A null canonical role is safer than silently returning a partner mark, product icon, UI glyph, or stale identity.

• ✓

  Public targets only. Private, loopback, and reserved network destinations are rejected, including after redirects.

• ✓

  Bounded network work. HTML, images, bundles, redirects, time, and candidate counts have explicit ceilings.

• ✓

  Validated content. A response claiming to be an image is not trusted until its bytes pass format and renderability checks.

• ✓

  Hardened demo route. JSON-only input, origin checks, rate limits, coalescing, concurrency control, generic errors, and restrictive browser headers.

• Some websites block automated clients or hide assets behind interactions that a bounded pass will not perform.
• A site may expose a product icon instead of its corporate identity.
• Dimensions and transparent-pixel bounds cannot identify every padded or unusually composed wordmark.
• Redirected, acquired, or rebranded domains can continue serving stale assets.

Use the canonical picks for the common path, but preserve the candidate evidence and variants when human review matters.