Request behavior

CORS and caching

SheetsDB sends CORS headers, but server-side requests keep your API key out of browser code. Each request fetches Google, although Google caching can delay recent edits.

By Zainul AriffinUpdated 13 August 2026

Call SheetsDB from your server

The API accepts cross-origin POST and OPTIONS requests. That does not make a browser request safe because the bearer API key would be visible in the client bundle and network panel.

Next.js route handler

const response = await fetch("https://www.sheetsdb.io/api/v1/getsheet", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SHEETSDB_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ sheetRef, hasHeader: true }),
});

What SheetsDB caches

SheetsDB sets API responses to no-store and fetches the Sheet for every request. Published Google Sheets can still take a short time to show a recent edit.

If your application can tolerate older data, cache the JSON in your own server using a duration that fits your update schedule.

Need a full example?

See the Next.js guide for a server-only route and error handling.