I try to create an api in nextjs to hide my backend api from display

<iframe ref={iframeRef} src={`/api/proxy/${id}/myfilename/?...my params here...`} style={{ display: 'none' }} />

In my api/proxy/[id]/[filename]

export default async (req: NextApiRequest, res: NextApiResponse) => {
    const { id, lang } = req.query;
   
        try {
            const response = await axios.get(
                `${process.env.NEXT_PUBLIC_API_URL}/pdf/${id}?lang=${lang}`,
                { responseType: 'arraybuffer' }
            );

            res.setHeader('Content-Type', 'application/pdf');
            res.send(response.data);
        } catch (error) {
            res.status(500).json({ error: 'An error occurred' });
        }
};

I am getting undefined for my lang in production, but when in my local it's fine. The production request url only show ...//api/proxy/[id]/[filename] without query param behind. Anyone encounter the same? How can i solve this?