Documentation

API Key Security

Keep CurrencyCore keys server-side, rotate with overlap, proxy browser traffic, and redact secrets from logs.

A key pasted into a browser bundle or a log line is public. The damage window is not instant either: a revoked key can keep authenticating for up to 5 minutes while the auth cache expires. Store keys in environment variables or a secret manager, keep them on the server, give each service its own key, and redact them before anything reaches a log processor.

There is no query-string authentication. Send the key in Authorization: Bearer <key> or x-api-key: <key> over HTTPS. CORS allows CurrencyCore origins, not arbitrary customer websites, so a browser caller cannot safely hold a key anyway. Put a backend proxy in front of the API and let that proxy attach the credential.

Test keys are useful for development, but they are not a sandbox: they return the same reference data and count against the monthly quota. Live keys require a paid plan. The monthly quota is shared by the organization, while the per-minute limit is enforced per key, so separate keys also separate rate-limit windows.

const key = process.env.CURRENCYCORE_API_KEY;
if (!key) throw new Error("CURRENCYCORE_API_KEY is not set");

function redact(line: string) {
  return line.replace(/cc_(live|test)_[A-Za-z0-9_-]+/g, "cc_$1_[redacted]");
}

console.info(redact(`calling /v1/rates with ${key}`));

Rotate with overlap rather than replacement:

Step	Action
1	Create the replacement key and deploy it to every service
2	Verify traffic succeeds on the new key
3	Revoke the old key and remove it from the secret store
4	Watch for rejected requests for at least 5 minutes

Least privilege means one key per service and environment, not one shared key for the whole organization. Never expose a key through a NEXT_PUBLIC_ or VITE_ variable, and never commit it with a local .env file.