Deezer API from JavaScript

Why your Deezer fetch() fails

api.deezer.com answers without an Access-Control-Allow-Origin header. The request reaches Deezer and the JSON comes back, but the browser refuses to hand it to your script and logs a blocked-by-CORS-policy error. The proxy fetches the same URL and returns it with the header added. The Axios CORS error guide uses api.deezer.com as its example too.

Search tracks, artists and albums

/search returns tracks, /search/artist artists and /search/album albums. Each track carries nested artist and album objects, duration in seconds and a preview URL. A page holds 25 results by default and up to 100 with limit.

async function deezer(path) {
  const response = await fetch(`https://proxy.cors.dev/https://api.deezer.com${path}`, { credentials: 'omit' });
  if (!response.ok) {
    throw new Error(`Deezer request failed: ${response.headers.get('X-Cors-Error') ?? response.status}`);
  }

  // Deezer reports errors with HTTP 200 and an error object
  const data = await response.json();
  if (data.error) throw new Error(`Deezer error ${data.error.code ?? ''}: ${data.error.message}`);
  return data;
}

const results = await deezer(`/search?q=${encodeURIComponent('daft punk')}&limit=10`);
const tracks = results.data.map((track) => ({
  id: track.id,
  title: track.title,
  artist: track.artist.name,
  album: track.album.title,
  cover: track.album.cover_medium,
  seconds: track.duration,
  preview: track.preview,
}));

console.log(results.total, tracks[0]);

Deezer documents field filters inside q, such as artist:"..." and track:"...". In our tests a single track:"one more time" filter worked with 283 results, but artist:"daft punk" returned 0 and every combination, like artist:"eminem" track:"lose yourself", returned 0 too. The plain query eminem lose yourself put the right track first, so start with plain text. order=RANKING and order=DURATION_DESC did not change the order either.

Deezer API endpoints and response sizes

Apple's iTunes Search API is the keyless option that needs no proxy at all: https://itunes.apple.com/search?term=daft+punk&entity=song&limit=3 sent Access-Control-Allow-Origin: * and returned 3 songs with previewUrl in 4.6 KB.

Artists, albums, charts and radio

• Artist: /artist/ID has nb_album, nb_fan and picture URLs; add /top, /albums or /related for top tracks, the discography or similar artists.
• Album and track: /album/ID includes release_date and the full track list; /track/ID adds isrc, gain and the preview URL.
• Charts: /chart returns 10 each of tracks, albums, artists, playlists and podcasts; /chart/0/tracks gives 10 by default and 300 with a high limit.
• Genres and radio: /genre lists genre IDs, /genre/ID/artists the artists in one, and /radio the radio stations.

Charts, genres and radio depend on the IP that calls Deezer. /infos reported country_iso FR when our test server called directly and DE through the proxy, and /radio listed 303 stations directly against 93 to 152 through the proxy on the same day. Expect the proxy location, not your visitor country.

Pagination with index, limit and next

List endpoints take index (an offset) and limit and return total plus a next URL while more remain. limit=500 on search still gave 100 items and a next link at index=100. next is an absolute api.deezer.com URL, so turn it back into a path before you fetch it, or the browser calls Deezer directly and hits the CORS error again.

async function deezerAll(path, max = 500) {
  const items = [];
  let next = new URL(path, 'https://api.deezer.com');

  while (next && items.length < max) {
    const page = await deezer(next.pathname + next.search);
    items.push(...page.data);
    next = page.next ? new URL(page.next) : null;
  }
  return items.slice(0, max);
}

const albums = await deezerAll('/artist/27/albums?limit=25');
console.log(albums.length, albums.map((album) => album.title));

Daft Punk's 38 albums came back in 2 requests of 25.

Play the 30-second previews

Every track has a preview field with a signed MP3 on cdnt-preview.dzcdn.net. The one we checked was 479,827 bytes, 30 seconds at 128 kbps, served as audio/mpeg with Access-Control-Allow-Origin: *. An audio element plays it, and even fetch() can read it, with no proxy. Through the free tier it fails: binary audio returns 502 with X-Cors-Error: unsupported_response.

// Markup: <ol id="tracks"></ol>
const list = document.querySelector('#tracks');

list.replaceChildren(
  ...tracks.map((track) => {
    const item = document.createElement('li');
    const cover = document.createElement('img');
    const audio = document.createElement('audio');

    cover.src = track.cover;
    cover.alt = '';
    cover.width = 56;
    cover.height = 56;

    // The MP3 streams straight from Deezer's CDN, which allows any origin
    audio.controls = true;
    audio.preload = 'none';
    if (track.preview) audio.src = track.preview;

    item.append(cover, `${track.artist}: ${track.title} `, audio);
    return item;
  }),
);

The link expires. The exp= value in its hdnea parameter is a Unix time 900 seconds after the API call, and an expired or edited link returns 403. Request the track again for a fresh URL instead of storing previews.

Errors arrive as HTTP 200

Deezer reports most errors with status 200 and an error object, so response.ok is not enough. The deezer() helper above checks data.error.

Deezer's developer support documents a limit of 50 requests per 5 seconds per IP. When we fired 120 requests at once directly, 62 came back with code 4; later bursts of the same size passed, so enforcement varies. A few large bursts through the proxy also drew 403 Access Denied pages from Deezer's edge. Retry code 4 and 403 after a short wait. Through the proxy Deezer sees the proxy's address, which other proxy users share.

JSONP versus the proxy

Deezer still answers output=jsonp&callback=NAME with text/javascript, and its developer FAQ suggests JSONP to avoid CORS errors. JSONP is GET-only, runs Deezer's response as a script in your page, hides HTTP status codes, and the next links keep the callback parameters. A proxied fetch() returns plain JSON you can await, check and cache.

Free tier limits for Deezer calls

• Size: 1 MiB per decoded response; the largest call here, 300 chart tracks, was 632 KB.
• Rate: 600 requests per minute per client IP on cors.dev; Deezer's own limit of 50 per 5 seconds is lower.
• Keys: calls with an access_token in the URL return 400 on the free tier; Pro forwards keys in the URL.
• Text only: JSON passes; images and MP3s return 502 unsupported_response, but img and audio tags load both straight from Deezer's CDN.

Good questions.