Deno Edge Function Food Nutrition API Proxy

A Deno edge function food nutrition API proxy runs your secret key close to users worldwide. Deno runtime powers Supabase Edge Functions, Deno Deploy, and Netlify Edge. This guide shows one handler pattern you can deploy anywhere to proxy Calorie API for mobile and web clients.

Why Deno for Food API Proxies

If you use Supabase specifically, also read Supabase edge function proxy.

Universal Handler Pattern

main.ts (Deno Deploy example):

const UPSTREAM = 'https://api.calorieapi.com/api/v1';
const API_KEY = Deno.env.get('CALORIE_API_KEY');

function json(body: unknown, status = 200) {
  return new Response(JSON.stringify(body), {
    status,
    headers: {
      'Content-Type': 'application/json',
      'Access-Control-Allow-Origin': '*',
    },
  });
}

Deno.serve(async (req) => {
  if (req.method === 'OPTIONS') {
    return new Response(null, { headers: { 'Access-Control-Allow-Origin': '*' } });
  }

  if (!API_KEY) return json({ error: 'Misconfigured' }, 500);

  const url = new URL(req.url);
  const path = url.pathname;

  if (path === '/search') {
    const q = url.searchParams.get('q')?.trim() ?? '';
    const limit = Math.min(parseInt(url.searchParams.get('limit') ?? '10', 10) || 10, 25);
    if (q.length < 2 || q.length > 100) return json({ error: 'Invalid query' }, 400);

    const upstream = await fetch(
      `${UPSTREAM}/search/foods?q=${encodeURIComponent(q)}&limit=${limit}`,
      { headers: { 'X-API-Key': API_KEY } }
    );
    return new Response(await upstream.text(), {
      status: upstream.status,
      headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
    });
  }

  if (path.startsWith('/barcode/')) {
    const upc = path.replace('/barcode/', '');
    if (!/^\d{8,14}$/.test(upc)) return json({ error: 'Invalid barcode' }, 400);

    const upstream = await fetch(`${UPSTREAM}/search/barcode/${upc}`, {
      headers: { 'X-API-Key': API_KEY },
    });
    return new Response(await upstream.text(), {
      status: upstream.status,
      headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
    });
  }

  return json({ error: 'Not found' }, 404);
});

Deploy Targets

Security Checklist

1. Validate q length and barcode regex
2. Restrict CORS to your app origin in production
3. Optional JWT gate before upstream call
4. Log status codes, never log API keys
5. Add per-IP rate limits via Upstash on Deno Deploy

Client Usage

const res = await fetch('https://your-edge.example.com/search?q=oats&limit=10');
const { results } = await res.json();

Mobile apps (Flutter, SwiftUI, Kotlin) use the same URL.

Deno vs Node Firebase Functions

Pick one proxy; do not duplicate keys across three backends.

Related Guides

• Backend proxy pattern
• Food API without exposing key
• Firebase Cloud Function proxy

Register free | Documentation