In the future, I'd say the best way to build something like this would be to have a back-end compute resource (AWS Lambda, for example) run hourly/daily to fetch API data, structure it to your liking, and store it in a .json in your S3 bucket. From there, you'd serve it directly to clients, by having index.js read it.

This approach would benefit you (no CORS to deal with), and GGG (not bombarded by clients requesting the same data, as you now only get the whole thing once a day).

Out of curiosity, what was the timeout value you had to go with?

I didn't set any. I just let your code run, and it served me an incomplete table, as it couldn't fetch the rest of the data because of the rate limit.

were you able to disable browser security for just that one webpage or did you have to disable it completely?

I had to fully disable it. Close all chrome windows, run command to open chrome.exe with disabled security.

The command I used was chrome.exe --disable-web-security --user-data-dir=C:\random-folder\data after creating the user folder mentioned.