Build the interface in React, but call the exchange-rate provider from your server so credentials, caching, and fallback behavior stay outside the browser.
The safest React currency converter has two layers: a small component that requests a conversion from your own route, and a server handler that calls the upstream API with a timeout and server-side key.
Key points
Never put a production exchange-rate API key in a React client bundle.
Return rate, converted amount, source, and observation time from your server route.
Handle loading, invalid amounts, upstream errors, and stale fallback explicitly.
Debounce typing or submit deliberately instead of fetching on every keystroke.
Create the server-side conversion route
This Next.js route validates the three inputs, calls exchangerate.dev on the server, and forwards the documented JSON response. The API key remains in the deployment environment.
Validate currency codes against a server-owned allowlist.
Cache successful observations for the cadence your product actually needs.
Show the last observation time rather than pretending every render fetched a new rate.
Keep the last successful value during a short outage and label it stale.
Use decimal-safe money handling when the converted value enters accounting or billing.
Client-side anonymous calls are for demos
A keyless browser call can prove the interface works, but production traffic needs a server boundary for quotas, abuse controls, caching, and credential management.