diff --git a/bin/telebitd.js b/bin/telebitd.js
index 10071d7..4149f2d 100755
--- a/bin/telebitd.js
+++ b/bin/telebitd.js
@@ -15,6 +15,8 @@ var url = require('url');
 var path = require('path');
 var os = require('os');
 var fs = require('fs');
+var urequest = require('@coolaj86/urequest');
+var urequestAsync = require('util').promisify(urequest);
 var common = require('../lib/cli-common.js');
 var http = require('http');
 var TOML = require('toml');
@@ -328,6 +330,20 @@ controllers.ssh = function (req, res, opts) {
   state.config.sshAuto = sshAuto;
   sshSuccess();
 };
+controllers.relay = function (req, res, opts) {
+  if (!opts.body) {
+    res.statusCode = 422;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({"error":{"message":"module \'relay\' needs more arguments"}}));
+    return;
+  }
+
+  return urequestAsync(opts.body).then(function (resp) {
+    res.setHeader('Content-Type', 'application/json');
+    var resp = resp.toJSON();
+    res.end(JSON.stringify(resp));
+  });
+};
 
 var serveStatic = require('serve-static')(path.join(__dirname, '../lib/admin/'));
 function handleRemoteClient(req, res) {
@@ -668,6 +684,10 @@ function handleApi(req, res) {
       listSuccess();
       return;
     }
+    if (/relay/.test(opts.pathname)) {
+      controllers.relay(req, res, opts);
+      return;
+    }
 
     res.setHeader('Content-Type', 'application/json');
     res.end(JSON.stringify({"error":{"message":"unrecognized rpc"}}));
diff --git a/lib/admin/js/telebit.js b/lib/admin/js/telebit.js
index 7ba8a31..bb7fe75 100644
--- a/lib/admin/js/telebit.js
+++ b/lib/admin/js/telebit.js
@@ -3,8 +3,17 @@
 
 var common = exports.TELEBIT = {};
 
+/* global Promise */
+var PromiseA;
+if ('undefined' !== typeof Promise) {
+  PromiseA = Promise;
+} else {
+  throw new Error("no Promise implementation defined");
+}
+
 if ('undefined' !== typeof fetch) {
   common.requestAsync = function (opts) {
+    /*
     if (opts.json && true !== opts.json) {
       opts.body = opts.json;
     }
@@ -16,13 +25,31 @@ if ('undefined' !== typeof fetch) {
         opts.headers.Accepts = 'application/json';
       }
     }
-    return window.fetch(opts.url, opts).then(function (resp) {
+    */
+    // funnel requests through the local server
+    // (avoid CORS, for now)
+    var relayOpts = {
+      url: '/api/relay'
+    , method: 'POST'
+    , headers: {
+        'Content-Type': 'application/json'
+      , 'Accepts': 'application/json'
+      }
+    , body: JSON.stringify(opts)
+    };
+    return window.fetch(relayOpts.url, relayOpts).then(function (resp) {
       return resp.json().then(function (json) {
+        /*
         var headers = {};
         resp.headers.forEach(function (k, v) {
           headers[k] = v;
         });
         return { statusCode: resp.status, headers: headers, body: json };
+        */
+        if (json.error) {
+          return PromiseA.reject(new Error(json.error && json.error.message || JSON.stringify(json.error)));
+        }
+        return json;
       });
     });
   };