What authentication method does Exchangerate.host use?

Exchangerate.host primarily uses API key authentication. You include a unique key as a query parameter in your API requests to verify your identity and authorize access.

How do I get my Exchangerate.host API key?

You can obtain your API key by signing up for an account on the Exchangerate.host website. After logging in, your key will typically be available in your user dashboard or account settings.

Is it safe to include my API key directly in the URL?

While Exchangerate.host uses URL query parameters for API keys, it's critical to always use HTTPS (SSL/TLS) for all requests. This encrypts the entire URL, including your API key, in transit. For server-side applications, store the key in environment variables and avoid hardcoding.

Can I use Exchangerate.host without an API key?

No, an API key is required for all requests to the Exchangerate.host API, even for the free tier. It identifies your application and helps manage usage limits.

What should I do if my Exchangerate.host API key is compromised?

If you suspect your API key has been compromised, you should immediately generate a new key from your Exchangerate.host dashboard and replace the old one in all your applications. You may also want to review your API usage logs for unusual activity.

Does Exchangerate.host support OAuth 2.0?

Based on its documentation, Exchangerate.host primarily supports API key authentication. There is no indication of direct OAuth 2.0 support for accessing its core currency rate API.

Are there any rate limits tied to authentication?

Yes, your Exchangerate.host API key is tied to your subscription plan, which determines your request rate limits. Exceeding these limits can result in blocked requests until the next billing cycle or plan upgrade.

Exchangerate.host Authentication: API Key Guide (2026)

Authentication overview

Exchangerate.host utilizes API key authentication to manage access to its currency exchange rate data. This approach is common for APIs that provide read-only access to public or semi-public datasets, offering a balance between ease of use and necessary security measures. An API key acts as a unique identifier for your application, linking your requests to your user account and its associated plan limits Exchangerate.host pricing details. All API communication is expected to occur over HTTPS to ensure that data, including your API key, is encrypted in transit.

While API keys are simpler to implement compared to more complex schemes like OAuth 2.0, they require careful handling. They are typically embedded directly into your API requests, which means they must be protected from unauthorized exposure. The Exchangerate.host API is designed to provide real-time and historical currency data, making secure authentication crucial for preventing misuse and ensuring the integrity of the data consumed by your application.

Supported authentication methods

Exchangerate.host primarily supports API key authentication. This method is suitable for most applications requiring access to currency data, from simple scripts to more complex web services. The API key distinguishes legitimate requests from unauthorized ones and helps enforce rate limits associated with your subscription plan.

The following table outlines the authentication method supported by Exchangerate.host:

Method	When to Use	Security Level
API Key	Accessing real-time and historical currency data via direct API calls. Suitable for server-side applications, mobile apps, and browser-based clients that properly secure API keys.	Moderate. Provides client identification and rate limiting. Relies on secure key storage and transmission (HTTPS).

API keys are generally considered a simpler form of token-based authentication, as described in RFC 6750 for Bearer Token usage, though API keys often lack the expiration and refresh mechanisms found in full OAuth 2.0 implementations. For Exchangerate.host, the key itself is the primary credential.

Getting your credentials

To obtain your API key for Exchangerate.host, you typically need to sign up for an account. Upon registration, a unique API key is generated and made available through your user dashboard. This process involves:

Sign Up/Log In: Navigate to the Exchangerate.host homepage and either register for a new account or log in to an existing one.
Access Dashboard: After successful login, you will be directed to your personal dashboard or account management page.
Locate API Key: The API key is usually prominently displayed within the dashboard, often under sections like "API Keys," "Settings," or "Developers." Refer to the Exchangerate.host API documentation for the exact location.

It is critical to treat your API key as a sensitive credential. Do not embed it directly into front-end client-side code without proper proxying, and avoid committing it to version control systems. Once obtained, store your API key securely, preferably in environment variables or a secure configuration management system.

Authenticated request example

When making requests to the Exchangerate.host API, your API key is included as a query parameter in the URL. Below is an example of an authenticated request using cURL to retrieve the latest exchange rates:

curl "https://api.exchangerate.host/latest?base=USD&symbols=EUR,GBP&source=ecb&api_key=YOUR_API_KEY"

In this example:

https://api.exchangerate.host/latest is the API endpoint for retrieving the latest rates.
base=USD specifies the base currency as United States Dollar.
symbols=EUR,GBP requests rates for Euros and British Pounds.
source=ecb specifies the data source as the European Central Bank.
api_key=YOUR_API_KEY is the critical authentication parameter. You must replace YOUR_API_KEY with the actual key retrieved from your Exchangerate.host dashboard.

Always ensure that your requests are made over HTTPS to encrypt the API key and other data in transit. Failure to do so could expose your credentials to interception.

Security best practices

Adhering to security best practices for API keys is essential to prevent unauthorized access and protect your account from misuse. Even for read-only APIs like Exchangerate.host, compromised keys can lead to exceeding rate limits, denial of service for your application, or other vulnerabilities. Implement the following recommendations:

Use HTTPS for All Requests: Always use HTTPS (https://) when making API calls. This encrypts the communication channel between your application and the Exchangerate.host API, protecting your API key and data from eavesdropping during transmission. The Mozilla Developer Network defines TLS (which HTTPS uses) as fundamental for secure web communication.
Server-Side Storage: Store your API key on the server-side whenever possible. Avoid embedding API keys directly into client-side code (e.g., JavaScript in a web browser, mobile application binaries) where they can be easily extracted by end-users. If client-side access is unavoidable, consider setting up a proxy server to mediate requests and inject the API key securely from your server.
Environment Variables: For server-side applications, store API keys in environment variables rather than hardcoding them directly into your source code. This practice prevents the key from being exposed if your codebase is compromised or shared.
Version Control Exclusion: Never commit API keys or configuration files containing API keys into public or private version control systems (e.g., Git repositories). Use .gitignore files or similar mechanisms to exclude these files from being tracked.
Rate Limit Monitoring: Regularly monitor your API usage and stay within your subscription's rate limits. Unusual spikes in usage could indicate a compromised key or an issue with your application, as detailed in the Exchangerate.host pricing and usage policies.
Key Rotation: Periodically rotate your API keys. While Exchangerate.host documentation does not specify an automatic rotation feature, manually generating a new key and retiring the old one can mitigate the risk associated with long-lived credentials. Check your dashboard for options to generate new keys.
IP Whitelisting (if available): If Exchangerate.host offers IP whitelisting capabilities, configure it to allow requests only from your application's specific server IP addresses. This adds an extra layer of security, ensuring that even if a key is stolen, it cannot be used from an unauthorized location.
Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. This can prevent sensitive information from being exposed in error messages and help diagnose issues related to incorrect or expired keys.