Answer · Frontend · Security

Pinnacle odds in browser JavaScript

Updated 10 November 2026 · PinnFeed · 2 min read

Answer: /v1/* REST responses include Access-Control-Allow-Origin: *, so fetch() from a web page works without a CORS error. The problem is the key: anything in front-end code is visible to every visitor. For anything public, call PinnFeed from a small server (or serverless function) that holds PINNFEED_KEY and returns only what the page needs. Browsers cannot set headers on a WebSocket, so a browser socket would need ?key= in the URL, which exposes it the same way.

Fine for a private test#

<script>
fetch('https://pinnfeed.io/v1/odds?sport=tennis&market=moneyline&main=true&limit=5', {
  headers: { 'x-api-key': 'ps_live_your_key' }   // visible to anyone who opens this page
}).then(r => r.json()).then(d => console.log(d.events));
</script>

Public site: proxy pattern#

// server.js (Node 18+), run with PINNFEED_KEY in the environment
import http from 'node:http';
http.createServer(async (req, res) => {
  if (!req.url.startsWith('/odds')) { res.writeHead(404).end(); return; }
  const r = await fetch('https://pinnfeed.io/v1/odds?sport=tennis&market=moneyline&main=true&limit=20', {
    headers: { 'x-api-key': process.env.PINNFEED_KEY },
  });
  res.writeHead(r.status, { 'content-type': 'application/json', 'cache-control': 'max-age=5' });
  res.end(await r.text());
}).listen(3000);

A short cache keeps many visitors from spending your rate limit (Free 1 req/s, Hobby 2, Builder 10, Pro 30). Ready-made proxies: FastAPI, Cloudflare Worker, Supabase Edge Function.

Live updates in the page#

Keep the WebSocket on your server (Builder), and forward only the changes you need to the browser over your own WebSocket or Server-Sent Events. Node reconnect pattern.

Plans#

Free REST works for prototypes (30 s delay). Builder (€99/mo) adds real-time WebSocket push. 3-day trial; a card is required and it is charged after day 3 unless you cancel. Leaked a key? Rotate it.

Educational content for adults (18+).

Questions people ask#

Can I restrict a key to my domain?#

There is no per-domain restriction on keys, which is why the proxy is the safe pattern.

Does the WebSocket send CORS headers?#

CORS does not apply to WebSockets; the issue there is that the key must be in the URL from a browser.

Can I redistribute the odds on my site?#

Check the terms; a commercial licence is an Enterprise topic.