Do I need an API key to get exchange rates?

Not to try it. All exchangerate.dev data endpoints answer anonymous requests at 12 requests a minute and 100 an hour per IP. You need a key when you want your own quota — the free tier is 10,000 calls a month — or when your calls run on a schedule or from other people’s machines.

Is the free exchange rate API key really free?

Yes. Signup asks for an email only — no credit card. The free tier is 10,000 calls a month at 12 requests a minute with one year of history. It hard-caps instead of billing overage, so it cannot silently start charging.

What does an exchangerate.dev API key look like?

It is a string starting with exr_live_. You send it as an Authorization: Bearer header, or as X-API-Key if your tool cannot set Authorization headers.

Can I use the free key in a commercial product?

Free keys are for internal use — dashboards, models, backtests, internal tools. Showing the rates inside a product you sell or distribute requires the Basic or Pro tier; see /pricing for current limits.

Is it safe to put the API key in the URL?

No. Query strings end up in server logs, proxies, and browser history. Send the key in a header, keep it in an environment variable server-side, and never ship it inside client-side JavaScript.

Guide/Free API key

How to get a free exchange rate API key (and when you don’t need one)

You can call the exchangerate.dev API with no key at all — 12 requests a minute, straight from curl or a browser. A free key takes about a minute to create and raises that to 10,000 calls a month with your own quota. This guide shows both paths and where each one stops.

ERexchangerate.dev·Aug 9, 2026·4 min read

Two honest answers, shortest first. For trying the API you need no key: every data endpoint — /v1/latest, /v1/convert, /v1/range, /v1/{date} — answers anonymous requests at 12 requests a minute and 100 an hour per IP. For anything that runs on a schedule or ships to other people, sign up at exchangerate.dev/signup, confirm your email, and copy the key that starts with exr_live_ from the dashboard. Free tier: 10,000 calls a month, 12 requests a minute, one year of history, no credit card.

Key points

No key needed to test: all data reads answer anonymously at 12 requests a minute, 100 an hour per IP.

The free key is created at /signup — email confirmation, no credit card — and looks like exr_live_....

Free tier: 10,000 calls a month, 12 requests a minute, one year of history, live rates where live exists.

Send the key as Authorization: Bearer exr_live_..., or X-API-Key when a connector cannot set the Authorization header.

Never put the key in a URL or a public browser bundle — headers only, proxied server-side for front-ends.

The no-key path: try the API first

Before creating anything, call the API and look at a real payload. This works from any terminal with no signup:

curl · anonymouscopy

# No key, no signup — works at 12 req/min, 100 req/hour per IP
curl -s https://api.exchangerate.dev/v1/latest/USD

# A single pair, converted
curl -s https://api.exchangerate.dev/v1/convert/USD/JPY/250

Every response carries source and market_session, so you can see whether a rate is a live consensus or the ECB daily fix before you decide anything. You can also run the same call in the browser and read the JSON there.

When anonymous is genuinely enough

A one-off script, a classroom exercise, or checking a rate by hand fits inside 100 requests an hour. If that is your whole use case, you are done — no key, nothing to store or rotate.

Get the free key

Open exchangerate.dev/signup and register with your email. There is no credit-card step.
Confirm the email. Your dashboard opens with an API key already provisioned.
Copy the key — it starts with exr_live_. This prefix is how you recognize it in configs later.

The free tier is 10,000 calls a month at 12 requests a minute, with one year of daily history and live rates where live coverage exists. That is the same data quality paid tiers read — tiers differ by volume and request rate, not by freshness.

Use the key: headers, never URLs

Pass the key in a header. Authorization: Bearer is the primary form; X-API-Key exists for connectors that cannot set an Authorization header (some BI tools and no-code platforms):

curl · authenticatedcopy

# Primary form
curl -s https://api.exchangerate.dev/v1/latest/USD \
  -H "Authorization: Bearer exr_live_your_key_here"

# Fallback for connectors without Authorization support
curl -s https://api.exchangerate.dev/v1/latest/USD \
  -H "X-API-Key: exr_live_your_key_here"

Keep the key out of query strings, out of client-side JavaScript bundles, and out of version control. In application code, read it from an environment variable; for a public front-end, route calls through a small server-side proxy so the key never reaches the browser.

Which path do you actually need?

SituationAnonymousFree key

Trying the API, one-off checksYes — 12 req/min per IPWorks too, not required

A cron job or scheduled refreshFragile — shares the per-IP capYes — your own 10,000/mo quota

A workbook or sheet others refreshNo — their IPs, their capsYes — quota follows the key

A product you sell or distributeNoNo — Basic or Pro tier (/pricing)

Indicative rates, not for settlement

Anonymous or keyed, the rates are the same: indicative mid-market data for models, analytics, and display — not a dealing quote. Every response repeats this in its notice field.

exchangerate.dev

Integration guides for developers.

The no-key path: try the API first

Get the free key

Use the key: headers, never URLs

Which path do you actually need?

Keep reading