How to Scrape Pinterest Pins and Boards in 2026: A Developer's Guide

Pinterest hosts over 240 billion pins across millions of boards, making it one of the richest public sources of visual trend data on the web. If you're building datasets for trend analysis, content research, or e-commerce intelligence, learning how to scrape Pinterest pins and boards in 2026 is a high-value skill. This guide walks through Pinterest's internal Resource API, proxy strategy, and production-ready code examples.

Legal caveat: This guide covers access to publicly available Pinterest data only. Scraping must comply with Pinterest's Terms of Service, the Computer Fraud and Abuse Act (CFAA) in the United States, and the General Data Protection Regulation (GDPR) in the European Union. Do not scrape login-walled content, personal data subject to GDPR, or any material that violates platform terms. When in doubt, use the official Pinterest API v5.

How to Scrape Pinterest Pins and Boards in 2026: Public vs Login-Walled Data

Not all Pinterest data is equally accessible. Before writing a single line of code, you need to understand which surfaces are public and which require authentication.

Publicly accessible without login

• Pin pages — Individual pin URLs (e.g., pinterest.com/pin/123456/) are publicly viewable and contain pin metadata, image URLs, descriptions, and the source link.
• Board feeds — Public boards expose their pins to anyone, including search engines. Board URLs like pinterest.com/username/board-slug/ render a paginated grid of pins.
• Search results — Pinterest search is accessible without login at pinterest.com/search/pins/?q=your+query, returning a ranked list of pins.
• User profiles — Public profiles list boards and some aggregate stats.

Login-walled or restricted

• Home feed — The personalized "Today" and home feed requires authentication and is algorithmically tailored per user.
• Private boards — Secret boards are not accessible without an invitation.
• Personalized recommendations — "Picked for you" and similar sections require a logged-in session.

The official Pinterest API v5

Pinterest offers a REST API (v5) with endpoints for boards, pins, and analytics. However, it is designed primarily for advertisers and content managers, not for bulk data collection. Rate limits are strict (typically 1,000 requests per minute for most endpoints), and access requires app registration and OAuth. For large-scale trend research, the API's scope and throughput often fall short — which is why developers turn to Pinterest API scraping via the platform's internal endpoints.

Understanding Pinterest's Internal Resource API

Pinterest's web frontend is a single-page application that fetches data from internal endpoints under /resource/. These endpoints return JSON and are the backbone of every page you see in the browser. The key endpoints for a Pinterest scraper include:

• /resource/PinResource/get/ — Fetches a single pin's full metadata by ID.
• /resource/BoardFeedResource/get/ — Returns a paginated list of pins for a given board.
• /resource/SearchResource/get/ — Returns search results for a query, scoped to pins, boards, or users.
• /resource/UserResource/get/ — Fetches user profile data.

Request structure

Every Resource API call uses two critical query parameters:

• source_url — The URL path that would normally render the page in the browser (e.g., /username/board-slug/). Pinterest uses this to determine context.
• data — A URL-encoded JSON object containing the request options. For BoardFeedResource, this includes the board URL, page size (typically 25), and a bookmarks array for pagination.

Required headers

Pinterest's backend inspects several headers to validate requests:

• X-Pinterest-PWS-Handler — Identifies the frontend handler (e.g., boards/[username]/[slug]/[slug].js). This must match the page context.
• X-APP-VERSION — A build hash that Pinterest updates periodically. You can extract the current value from any Pinterest page's HTML or network tab.
• csrftoken — A CSRF token set via cookies. For unauthenticated requests, Pinterest may still set a cookie on first visit — capture it and return it in subsequent requests.
• User-Agent — Must be a realistic, current browser UA string. Pinterest rejects requests with missing or bot-like user agents.

Anti-Bot Reality: Rate Limits and Proxy Strategy

Pinterest employs several layers of bot detection. Understanding these is essential to maintain a reliable Pinterest scraper at scale.

Per-IP rate limiting

Pinterest applies rate limits per IP address. In practice, sustained requests beyond ~50 per minute from a single IP trigger throttling (HTTP 429) or temporary blocks. Pinterest does not publicly document these thresholds, and they may vary by endpoint and geography.

Bot scoring and fingerprinting

Pinterest uses behavioral signals — request timing, header consistency, TLS fingerprint, and navigation patterns — to score each session. Requests that look automated (e.g., perfectly regular intervals, missing headers, datacenter IP ranges) receive higher bot scores and may be challenged with CAPTCHAs or silently rate-limited.

Why residential proxies with geo-targeting matter

Pinterest's search results and recommendations are localized. A search for "wedding decor" from a US IP returns different pins than the same search from a German IP. If your dataset needs consistent, reproducible results, you need to control the geographic origin of your requests.

Rotating residential proxies solve two problems simultaneously:

1. IP rotation distributes requests across many real ISP-assigned IPs, staying under per-IP rate limits.
2. Geo-targeting ensures results come from the right country or city, making datasets comparable.

Datacenter IPs are faster and cheaper but are easily flagged by Pinterest's bot detection. Mobile proxies offer the highest trust score but at higher cost and latency. For most Pinterest scraping workloads, residential proxies strike the best balance.

For a deeper dive into proxy infrastructure, see the ProxyHat documentation. To explore available geo-targeting options, check the proxy locations page.

Python Example: Scraping a Board Feed with ProxyHat

This example paginates a public board's pins using the BoardFeedResource endpoint through ProxyHat's residential proxy gateway. It uses a sticky session for cookie continuity and US geo-targeting for consistent results.

import requests
import json
import random
import time

# ProxyHat residential proxy — US geo, sticky session for cookie continuity
proxy_url = "http://user-country-US-session-pint01:pass@gate.proxyhat.com:8080"
proxies = {"http": proxy_url, "https": proxy_url}

headers = {
    "User-Agent": (
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
        "AppleWebKit/537.36 (KHTML, like Gecko) "
        "Chrome/120.0.0.0 Safari/537.36"
    ),
    "X-Pinterest-PWS-Handler": "boards/[username]/[slug]/[slug].js",
    "X-APP-VERSION": "b9f1c1a",
    "Accept": "application/json",
}

board_slug = "username/home-decor-ideas"
all_pins = []
bookmarks = []

for page in range(5):  # up to 5 pages = ~125 pins
    data_param = json.dumps({
        "options": {
            "board_url": f"/{board_slug}/",
            "page_size": 25,
            "current_count": len(all_pins),
            "bookmarks": bookmarks,
        },
        "context": {},
    })

    params = {
        "source_url": f"/{board_slug}/",
        "data": data_param,
    }

    resp = requests.get(
        "https://www.pinterest.com/resource/BoardFeedResource/get/",
        headers=headers,
        params=params,
        proxies=proxies,
        timeout=30,
    )

    body = resp.json()
    resource_data = body.get("resource_response", {}).get("data", [])

    for pin in resource_data:
        all_pins.append({
            "id": pin.get("id"),
            "title": pin.get("title", ""),
            "image_url": pin.get("images", {}).get("orig", {}).get("url", ""),
            "link": pin.get("link", ""),
        })

    # Extract bookmark for next page
    bookmarks = body.get("resource", {}).get("options", {}).get("bookmarks", [])
    if not bookmarks or bookmarks == ["-end-"]:
        break

    # Pacing: randomized delay between pages
    time.sleep(random.uniform(2.0, 5.0))

print(f"Collected {len(all_pins)} pins from board: {board_slug}")
for pin in all_pins[:3]:
    print(json.dumps(pin, indent=2))

The bookmarks array acts as a cursor — each response includes the bookmark for the next page. When it contains "-end-" or is empty, you've reached the last page. The sticky -session-pint01 flag in the ProxyHat username ensures all requests in this loop use the same IP, which keeps the csrftoken cookie valid across pages.

Node.js Example: Pinterest Search via HTTP Gateway

For JavaScript-based scraping pipelines, here's a Node.js example using axios through ProxyHat's HTTP gateway on port 8080. It queries the SearchResource endpoint for a keyword and parses the first page of results.

const axios = require('axios');

async function searchPinterest(query, maxPins = 25) {
  const dataParam = JSON.stringify({
    options: {
      query: query,
      scope: 'pins',
      page_size: maxPins,
      bookmarks: [],
    },
    context: {},
  });

  const sourceUrl = `/search/pins/?q=${encodeURIComponent(query)}`;

  const response = await axios.get(
    'https://www.pinterest.com/resource/SearchResource/get/',
    {
      params: {
        source_url: sourceUrl,
        data: dataParam,
      },
      headers: {
        'User-Agent':
          'Mozilla/5.0 (Windows NT 10.0; Win64; x64) ' +
          'AppleWebKit/537.36 (KHTML, like Gecko) ' +
          'Chrome/120.0.0.0 Safari/537.36',
        'X-Pinterest-PWS-Handler': 'search/[query].js',
        'X-APP-VERSION': 'b9f1c1a',
        'Accept': 'application/json',
      },
      proxy: {
        protocol: 'http',
        host: 'gate.proxyhat.com',
        port: 8080,
        auth: {
          username: 'user-country-US-session-pint02',
          password: 'pass',
        },
      },
      timeout: 30000,
    }
  );

  const pins = response.data.resource_response?.data || [];
  return pins.map((pin) => ({
    id: pin.id,
    title: pin.title || '',
    image_url: pin.images?.orig?.url || '',
    link: pin.link || '',
  }));
}

// Usage
searchPinterest('minimalist interior design')
  .then((pins) => {
    console.log(`Found ${pins.length} pins`);
    pins.slice(0, 3).forEach((p) => console.log(JSON.stringify(p, null, 2)));
  })
  .catch((err) => console.error('Error:', err.message));

Both examples use gate.proxyhat.com:8080 with residential IPs geo-targeted to the US. The -session- flag maintains IP continuity within a scrape run, which is critical for endpoints that depend on cookie state.

Pagination, Sessions, and Fingerprint Hygiene

Bookmark-based cursor pagination

Pinterest does not use offset-based pagination. Instead, every Resource API response includes a bookmarks array in the resource.options field. Pass this array back in the next request's data parameter to fetch the next page. The bookmark is opaque — it encodes server-side state, not a simple page number. When the array contains "-end-", there are no more results.

Sticky sessions for cookie continuity

Pinterest sets a csrftoken cookie on first visit and expects it in subsequent requests. If your proxy rotates IPs between requests, the cookie may become invalid and you'll get 403 responses. Use ProxyHat's -session- flag to pin all requests in a scrape run to the same IP:

# Same IP for all requests in this session
http://user-country-US-session-myboard01:pass@gate.proxyhat.com:8080

Start a new session (new IP) only when moving to a different board or search query.

Pacing and request intervals

Even with rotating IPs, aggressive request patterns trigger bot detection. Best practices:

• Add randomized delays of 2-5 seconds between requests.
• Limit concurrency to 5-10 parallel requests per proxy session.
• Use a jittered interval (e.g., random.uniform(2.0, 5.0)) rather than fixed delays.
• Back off exponentially on HTTP 429 responses — wait 60 seconds, then retry.

User-agent and header hygiene

Bot detection systems compare your headers against known browser profiles. Common mistakes:

• Using outdated or mismatched UA strings (e.g., Chrome 90 on Windows 11).
• Omitting standard headers like Accept-Language or Accept-Encoding.
• Sending a mobile UA for desktop endpoints (or vice versa).
• Reusing the same UA across hundreds of sessions — rotate between 3-5 current, realistic UA strings.

Key Takeaways

• Use the Resource API, not HTML scraping. Pinterest's internal endpoints return structured JSON and are more reliable than parsing rendered HTML.
• Residential proxies with geo-targeting are essential. Pinterest localizes search and recommendations, so controlling the request's country ensures dataset consistency.
• Bookmark pagination is mandatory. Pinterest uses opaque cursor tokens, not page offsets. Always pass the bookmarks array forward.
• Sticky sessions preserve cookie state. Use ProxyHat's -session- flag to keep the same IP across a multi-page scrape.
• Pace your requests. 2-5 second randomized delays with 5-10 concurrent sessions per IP keeps you under Pinterest's per-IP rate thresholds.
• Rotate headers, not just IPs. Keep your User-Agent and X-APP-VERSION current with real browser values.

Ethical Scraping and When to Use Official APIs

Scraping Pinterest — or any platform — carries ethical and legal responsibilities. Here's a framework for staying on the right side of the line:

Scrape only public, non-personal data

Pin titles, descriptions, image URLs, board names, and search rankings are generally public. However, user profile data, email addresses, and any data that could identify a natural person is subject to GDPR in the EU and state privacy laws in the US. Do not collect personal data without a lawful basis.

Respect robots.txt

Pinterest's robots.txt defines which paths search engines may crawl. While it is not legally binding for non-search-engine crawlers, it signals the platform's preferences. Review it before scraping and avoid paths that are disallowed.

Rate-limit responsibly

Aggressive scraping degrades service for legitimate users. Keep your request volume reasonable — if your scraping impacts Pinterest's infrastructure, you're doing too much. A good rule of thumb: stay under 50 requests per minute per IP and use exponential backoff on errors.

Prefer the official API for production workloads

If you're building a product that depends on Pinterest data long-term, the Pinterest API v5 is the sustainable choice. It provides stable endpoints, documented rate limits, and a contractual relationship with Pinterest. Scraping is best suited for research, one-off data collection, or filling gaps the API doesn't cover.

For broader web-scraping strategies beyond Pinterest, see our web scraping use case guide. If you're also tracking search rankings across platforms, our SERP tracking resources may be useful. And when you're ready to scale, check ProxyHat pricing for residential proxy plans that fit your workload.

The CFAA and GDPR context

In the United States, the Computer Fraud and Abuse Act (CFAA) criminalizes unauthorized access to computer systems. Courts have generally held that accessing public web pages without authentication does not constitute a CFAA violation, but the legal landscape evolves. In the EU, GDPR Article 6 requires a lawful basis for processing personal data, and scraping personal data without consent may violate GDPR regardless of whether the data was publicly accessible.

The safest approach: scrape only public, non-personal data; respect platform terms; use the official API when it meets your needs; and consult legal counsel for large-scale or commercial projects.