diff --git a/backend/novasonic-server.js b/backend/novasonic-server.js
index f437f2f..567ab5b 100644
--- a/backend/novasonic-server.js
+++ b/backend/novasonic-server.js
@@ -251,7 +251,18 @@ async function fetchSpotifyToken() {
 
 async function _spApi(path, token) {
   const url = path.startsWith('http') ? path : `https://api.spotify.com/v1${path}`;
-  const r = await _fetchTimeout(url, { headers: { Authorization: `Bearer ${token}` } });
+  const r = await _fetchTimeout(url, {
+    headers: {
+      'Authorization':        `Bearer ${token}`,
+      'Origin':               'https://open.spotify.com',
+      'Referer':              'https://open.spotify.com/',
+      'app-platform':         'WebPlayer',
+      'spotify-app-version':  '1.2.46.25.g7f189073',
+      'User-Agent':           'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+      'Accept':               'application/json',
+      'Accept-Language':      'en-US,en;q=0.9',
+    },
+  });
   if (r.status === 429) {
     const retryAfter = parseInt(r.headers.get('Retry-After') || '10', 10);
     _spTokenCache  = null;
@@ -277,6 +288,7 @@ async function _spAllPlaylistTracks(id, token) {
       tracks.push(t);
     }
     path = page.next || null;
+    if (path) await new Promise(r => setTimeout(r, 300)); // pace multi-page requests
   }
   return { tracks, skippedLocal };
 }