Pinecone CORS error: keep API calls server-side

CORS: the browser is not the place for Pinecone calls

The error

No 'Access-Control-Allow-Origin' header is present on the requested resource.

It appears when a browser-based app calls the Pinecone API cross-origin. Pinecone's CORS implementation is restrictive; a local dev server hostname in particular trips the same-origin policy because the browser treats it as a different origin from the machine's IP.

Fix

Move Pinecone calls server-side. The browser talks to your backend; your backend talks to Pinecone with the API key. This also keeps the key out of shipped JavaScript, which is the more important win.

What not to do

1. Do not proxy with Access-Control-Allow-Origin: * hacks around a key-bearing endpoint. You would be CORS-enabling key exfiltration.
2. Do not ship the API key in frontend code to "fix" the error. The CORS error was protecting you.
3. Local development: run the backend locally and have the frontend call it; do not call Pinecone directly from the page even in dev.

Trap

Treating this as a Pinecone configuration issue. There is no dashboard toggle that makes browser-direct calls with a secret key safe. The architecture is the fix.

Pinecone's CORS troubleshooting page gives the exact error string and explains the same-origin-policy mismatch with local dev server hostnames, recommending an externally hosted server. Verified against live docs 2026-09-26.