# API Key Security

> Keep CurrencyCore keys server-side, rotate with overlap, proxy browser traffic, and redact secrets from logs.

Canonical: https://currency-core.com/docs/guides/security/
Updated: 2026-11-11
Published: 2026-11-11

---
A key pasted into a browser bundle or a log line is public. The damage window is not instant either: a revoked key can keep authenticating for up to 5 minutes while the auth cache expires. Store keys in environment variables or a secret manager, keep them on the server, give each service its own key, and redact them before anything reaches a log processor.

There is no query-string authentication. Send the key in `Authorization: Bearer <key>` or `x-api-key: <key>` over HTTPS. CORS allows CurrencyCore origins, not arbitrary customer websites, so a browser caller cannot safely hold a key anyway. Put a backend proxy in front of the API and let that proxy attach the credential.

Test keys are useful for development, but they are not a sandbox: they return the same reference data and count against the monthly quota. Live keys require a paid plan. The monthly quota is shared by the organization, while the per-minute limit is enforced per key, so separate keys also separate rate-limit windows.

```ts
const key = process.env.CURRENCYCORE_API_KEY;
if (!key) throw new Error("CURRENCYCORE_API_KEY is not set");

function redact(line: string) {
  return line.replace(/cc_(live|test)_[A-Za-z0-9_-]+/g, "cc_$1_[redacted]");
}

console.info(redact(`calling /v1/rates with ${key}`));
```

Rotate with overlap rather than replacement:

| Step | Action |
|---|---|
| 1 | Create the replacement key and deploy it to every service |
| 2 | Verify traffic succeeds on the new key |
| 3 | Revoke the old key and remove it from the secret store |
| 4 | Watch for rejected requests for at least 5 minutes |

Least privilege means one key per service and environment, not one shared key for the whole organization. Never expose a key through a `NEXT_PUBLIC_` or `VITE_` variable, and never commit it with a local `.env` file.

## Related

- [OpenAPI specification](/docs/openapi/)
- [Authentication](/docs/authentication/)
- [Errors](/docs/errors/)
- [Rate limits](/docs/rate-limits/)
- [Guides](/docs/guides/)