Call the odds API from a Cloudflare Worker

You should never call the odds API from browser JavaScript, because the key would be visible to every visitor. A Cloudflare Worker is the clean middle path: JavaScript that runs on the edge, server-side, where the key lives in a secret and never reaches a browser. Your page can stay static, and the odds call happens one hop from the reader.

The shape that keeps the secret

The Worker holds the key as an environment secret, not in the code, the same boundary the curl quickstart keeps with its environment variables, checked 2026-10-16. The page calls your Worker, the Worker calls the API with the key in the x-portal-apikey header, trims the response to what the page needs, and returns it. The browser sees your Worker's URL, never the API's, and never the key.

export default {
  async fetch(request, env) {
    const url = `${env.ODDS_BASE_URL}/kit/v1/markets?sport_id=1`;
    const r = await fetch(url, {
      headers: { "x-portal-apikey": env.ODDS_API_KEY }
    });
    const data = await r.json();
    const rows = data.events.slice(0, 20).map((ev) => ({
      home: ev.home, away: ev.away,
      line: ev.periods?.num_0?.money_line ?? null,
    }));
    return Response.json({ rows, last: data.last });
  },
};

The response keeps the envelope habit too: events plus the last cursor, so your page can ask for the next delta later.

Why the edge is worth it here

Odds pages are read-side heavy: many readers, one upstream. A Worker can cache the trimmed response for a few seconds at the edge, so a hundred readers of the same page cost one upstream call, the same one-reader-many-consumers principle the quickstarts use server-side. The free key's 100 calls a day stretch much further when the edge absorbs the traffic.

The alternative, a static page calling the API directly, puts the key in every visitor's hands, which is the one thing you cannot undo.

Keep the Worker honest

Trim before you send: the full board is large, and your page needs twenty rows, not hundreds. Keep the cursor out of the response if the page does not poll, and keep the key out of any URL, because a key in a URL ends up in logs. When the board fails, answer with an age, not an error page: your readers can live with slightly old prices, clearly labeled, better than with nothing.

Key in a secret, call at the edge, trim before you send. The Worker is the browser-safe way to put live prices on a static page.