dash.fetch

Published 11 November 2026

Make an HTTP request from a pane. Dotpane’s servers send it, so the browser’s CORS rules do not apply, and the request can carry a secret that the pane never sees.

dash.fetch(url: string, init?: DashFetchInit): Promise<DashResponse>

Example

Load the signed-in user from GitHub. The token is a secret called GITHUB_TOKEN, bound to the pane.

const res = await dash.fetch('https://api.github.com/user', {
  headers: { authorization: 'Bearer {{secrets.GITHUB_TOKEN}}' },
  cache: 60,
});

if (!res.ok) throw new Error(res.status + ' ' + res.statusText);
const user = await res.json();
document.querySelector('#name').textContent = user.login;

The placeholder is replaced on the server. The host must be listed under network in the pane’s manifest and in the secret’s allowed hosts, or the call is refused. A placeholder works in a header value, in the URL’s path and query, and in a text body.

Options

Option	Type	What it does
`method`	`string`	GET, POST, PUT, PATCH, DELETE or HEAD. The default is GET.
`headers`	`Record<string, string>`	Request headers. Put a secret placeholder where the key belongs and it is filled in on the server.
`body`	`string \| ArrayBuffer \| ArrayBufferView`	Text or binary. Not allowed with GET or HEAD. The whole request must fit in 300 KB once encoded.
`cache`	`number`	Keep the response for this many seconds, from 0 to 3600. GET only, and only a 200 answer is kept.

The URL must start with https://, use the default port and name a host, not an IP address.

The response

Member	What it holds
`ok`	True when the status is 200 to 299.
`status, statusText`	The status the API answered with.
`headers`	The response headers, with lower-case names.
`fromCache`	True when the answer came from the cache.
`text()`	The body as a string.
`json()`	The body parsed as JSON. Rejects with a SyntaxError if it is not JSON.
`arrayBuffer()`	The body as bytes.

Redirects are not followed: a 3xx answer comes back as it is. Only these response headers are passed to the pane: content-type, content-language, cache-control, etag, last-modified, expires, link, location, retry-after, x-ratelimit-*, ratelimit-* and x-total-count. If the answer repeats the value of a secret you sent, that value is replaced with [redacted].

Errors

An answer from the API with a 4xx or 5xx status is not an error: the promise resolves with ok: false. The promise rejects with a DashError only when Dotpane itself stops the call. Read its code.

Code	Why
`PROXY_URL_INVALID`	The URL is not `https`, uses another port, names an IP address, is longer than 2,048 characters, or has a placeholder in its host.
`PROXY_HOST_NOT_ALLOWED`	The host is not listed under network in the pane’s manifest.
`PROXY_SECRET_UNKNOWN_SLOT`	The placeholder names a secret slot that the pane’s manifest does not declare.
`PROXY_SECRET_NOT_BOUND`	The placeholder names a secret slot that has no secret bound to it on this pane.
`PROXY_SECRET_HOST_MISMATCH`	The secret is not allowed to go to this host.
`PROXY_BLOCKED_ADDRESS`	The host resolves to a private or internal address.
`PROXY_DNS_FAILED`	The host could not be resolved.
`PROXY_TIMEOUT`	The API did not answer within 10 seconds.
`PROXY_RESPONSE_TOO_LARGE`	The response is larger than 2 MB.
`PROXY_REQUEST_TOO_LARGE`	The body is larger than 256 KB, or the whole request is larger than 300 KB once encoded.
`PROXY_UPSTREAM_ERROR`	The connection to the API failed, for example a TLS error or a reset connection.
`RATE_LIMITED`	More than 60 calls in a minute, or more than 10 at once.
`QUOTA_EXCEEDED`	The account has used its API calls for the month.
`VALIDATION_FAILED`	The options are not valid, for example a body on a GET or a `cache` outside 0 to 3600.
`UNAUTHENTICATED`	You are no longer signed in.
`EGRESS_UNAVAILABLE`	Dotpane could not reach the service that sends the request. Try again shortly.
`KMS_UNAVAILABLE`	Dotpane could not decrypt the secret just now. Try again shortly.
`INTERNAL`	Something went wrong inside Dotpane.

Limits

A call times out after 10 seconds.
A response can be up to 2 MB, measured after it is decompressed.
A body can be up to 256 KB, and the whole request up to 300 KB once encoded, so binary bodies fit up to about 220 KB.
A request can have up to 30 headers, 8 KB in total.
An account can make 60 calls a minute, with 10 in flight at once.