API Documentation

Quickstart — Get Started in < 2 Minutes

curl "https://allratestoday.com/api/v1/rates?source=USD&target=EUR" \
  -H "Authorization: Bearer YOUR_API_KEY"

Overview

The AllRatesToday exchange rate API gives your application programmatic access to two complementary families of exchange-rate data through one REST interface: live mid-market rates for 160+ currencies, refreshed around the clock, and the official reference rates published by 116 central banks and 3 tax authorities — ingested directly from each publisher's own release and stored unmodified, with the publisher's publication date on every row. Responses are JSON by default; every table endpoint can also answer in CSV, XML or Excel.

All endpoints live under a single base URL:

https://allratestoday.com

Every endpoint requires an API key except /api/v1/symbols (the currency list). Plans differ only in how many requests a month you may make — there is no feature gating on the mid-market endpoints, and only two central-bank endpoints are paid-only. See Rate Limits & Quotas and the pricing page.

The whole API on one page

Six mid-market endpoints and six official-rate endpoints. Everything else in this documentation is a client library, an integration, or reference material for these twelve.

Two kinds of rate — which one do you need?

The API serves two deliberately separate families of rates. They answer different questions, and compliance rules often dictate which one you must use:

The two can differ by several percent: over Aug 2025–Aug 2026 the widest gap between the GBP/USD mid-market rate and HMRC's monthly rate-in-force was 3.7% — about £2,832 on a $100k invoice. Picking the right family is a correctness decision, not a preference. If a regulation or auditor names a source, use the official endpoints; otherwise the mid-market rate is the truer price.

Authentication

All API endpoints require authentication. Include your API key as a Bearer token:

Authorization: Bearer YOUR_API_KEY

Get your API key from your profile page after signing in.

Requests without a valid key receive a 401 Unauthorized response:

// 401 response — missing or invalid API key
{
  "error": "Authentication required. Provide an API key via Authorization header or log in."
}

If a key is ever compromised, rotate it immediately — revocation takes effect instantly — and email support@allratestoday.com if you need help investigating unexpected usage.

Passing the key in the query string

Two endpoints also accept the key as a query parameter, for callers that cannot set a header — a browser address bar, a spreadsheet's IMPORTDATA, a webhook tester:

The other endpoints — /api/historical-rates and every /api/v1/central-bank/… path — accept the header only.

Session authentication

/api/v1/rates and /api/historical-rates also accept a logged-in browser session instead of a key, which is what the site's own pages and the playground use. The quota is charged to the session user's key exactly as if the key had been sent. This exists so our own pages work; build integrations against the API key.

Security

The AllRatesToday API is designed with security as a first-class concern. This section explains the transport, authentication, and data-handling guarantees you can rely on, plus the responsibilities that sit on your side as an integrator.

Transport (TLS / HTTPS)

• All API traffic must be sent over HTTPS. Plain-text HTTP requests are permanently redirected (301) to HTTPS but should never be used for API calls — the redirect leaks your API key via the initial request.
• We require TLS 1.2 or higher. Connections using older TLS versions (1.0, 1.1) or SSLv3 are rejected at the edge.
• Certificates are issued by publicly-trusted CAs and automatically renewed. HSTS is enforced with max-age=31536000; includeSubDomains.

Network requirements (corporate firewalls)

• The only domain to allow is allratestoday.com on port 443 — every endpoint, including the central-bank API, lives under it.
• The API is served from Cloudflare's edge network, so there is no fixed origin IP. Do not allowlist individual IP addresses — allow Cloudflare's published IP ranges (they change; automate updates if your firewall supports it).
• Certificates come from multiple public CAs and rotate automatically — trust the standard set of modern public root CAs rather than pinning a specific CA or certificate.
• TLS-inspecting (SSL interception) proxies can break requests by re-signing with a private CA; if your organisation uses one, exclude allratestoday.com from inspection.
• Prefer TLS 1.3; TLS 1.2 is the minimum accepted.

Authentication

• Authentication uses a Bearer token in the Authorization header. Two endpoints additionally accept the key as a query parameter for non-programmatic callers — see Authentication — but query strings get logged by proxies, CDNs and browser history, so the header is the only form to use from a server.
• Every API key is scoped to one account and can be rotated or revoked instantly from your profile page. Revocation is immediate: the next request with the old key returns 401.
• Keys are stored server-side and remain retrievable from your profile page, so you can copy a key again later rather than rotating every environment when one is misplaced. The trade-off is that a key is a bearer credential in the full sense — anyone who can read it can spend your quota. Treat it like a password: secret store, never in git, never in a client bundle.
• Keys are prefixed art_live_ followed by 32 characters. There is no separate test key, sandbox environment or mock mode — staging and production call the same URLs and spend the same quota. Most plans issue one key per account (the Large plan allows three), so if you need to separate environments, budget for it in your quota rather than expecting a free test tier.

API key handling (your responsibilities)

• Server-side only. Call the AllRatesToday API from your backend. Proxy the result to your frontend.
• Use environment variables (process.env.ART_API_KEY). Never commit keys to git, never include them in container images.
• Rotate keys periodically — at minimum every 90 days, and immediately if a key is ever exposed in logs, commits, or error reports.
• Use one key per service. When a key leaks, you can revoke just that environment instead of rotating everything.

Abuse protection

• Rate limiting is applied per API key (see Rate Limits). Exceeding the limit returns 429 Too Many Requests; it does not leak usage data to other keys.
• WAF & DDoS: requests are filtered by Cloudflare's edge network, which applies OWASP Top 10 mitigations automatically. Malformed or abusive requests are rejected before reaching the API.
• Automated monitoring flags anomalous usage patterns (e.g. sudden 100× spikes) and can lock a key pending verification.

Data handling & privacy

• We log request metadata (timestamp, endpoint, status code, rate-limit counters) but never the response payload. Rate data is public.
• We do not collect or store any personal data you send in query strings — but please don't send any: all the API needs is currency codes and optional date parameters.
• Access logs are retained for 30 days for debugging and abuse investigation, then permanently deleted.
• AllRatesToday is operated from the UK and complies with UK GDPR. See the privacy policy for the full data-handling statement.

Reporting a vulnerability

If you believe you have found a security issue in the AllRatesToday API, please report it privately to support@allratestoday.com. Please do not disclose the issue publicly (on GitHub, Twitter, blog posts, etc.) until we have had a reasonable chance to respond.

We aim to acknowledge reports within 24 hours and provide a remediation timeline within 72 hours. Responsible disclosure is credited publicly after the fix is deployed (if you want to be named).

Rate Limits & Quotas

There is one limit that matters: the number of requests your key may make. It is a quota, not a per-second throttle — you can burst as fast as you like, and nothing is refused until the quota is spent.

What counts as one request

• Each HTTP call to an authenticated endpoint costs 1, whatever it returns. /api/v1/rates?source=USD&target=EUR,GBP,JPY is one request, not three — batching targets is free, and is the cheapest way to cut usage.
• Historical data is billed by volume, because one call can hand over a year of archive. /api/historical-rates?period=1y costs 12; 1d, 7d and 30d cost 1. On the central-bank /history endpoint the charge is one unit per calendar month of the requested range per series, and every response reports what it cost in billed_requests.
• /api/v1/symbols is keyless and costs 0. Cache it and stop paying for currency lists.
• A rejected 401 (bad key), 403 or 429 is never charged, and neither is a 400 from an unsupported ?format=, which is validated before authentication. Everything past that point is counted when the request is accepted — so a call that then fails on a bad currency code, or on an upstream error, does spend a unit. Validate currency codes against /api/v1/symbols rather than discovering them through failed calls.
• The quota is per key. A key that is rotated keeps the account's usage — rotating does not reset your counter.

Response headers

Quota headers are returned on the 429 response only — successful responses do not currently carry X-RateLimit-* or X-Monthly-* headers, so do not build a client that reads a remaining-count from a 200.

To watch your usage between calls, read the counters on your profile page, which shows today, this month, last month, and lifetime totals. There is no Retry-After header; use resets_at from the 429 body.

The 429 response

HTTP/1.1 429 Too Many Requests
X-Monthly-Limit: 5000
X-Monthly-Used: 5000
X-Monthly-Resets: 2026-09-01T00:00:00.000Z

{
  "error": "Request limit exceeded",
  "used": 5000,
  "limit": 5000,
  "plan": "small",
  "resets_at": "2026-09-01T00:00:00.000Z",
  "upgrade_url": "https://allratestoday.com/pricing"
}

A history request that would cross the limit is refused before any data is returned, and says so explicitly — “A 1y history request is billed as 12 API calls (one per month of data)” — rather than returning a truncated series.

We email you at 90% of your allowance and again when it is exhausted, so a quota does not run out silently in production. View plans and pricing · need a limit that is not on the list? Talk to us.

Handling a 429 in code

Retrying a quota 429 immediately never helps — the quota is not time-windowed at the second level, so a backoff loop just burns your own CPU. Fail over to a cached rate and alert instead:

const res = await fetch(url, { headers: { Authorization: `Bearer ${key}` } });

if (res.status === 429) {
  const { used, limit, resets_at } = await res.json();
  // Do not retry: the allowance is spent until resets_at (or until you upgrade).
  logger.error(`FX quota exhausted: ${used}/${limit}, resets ${resets_at}`);
  return lastKnownRate;   // serve stale rather than fail the checkout
}

if (!res.ok) throw new Error(`FX API ${res.status}`);
return (await res.json())[0].rate;

Authenticated Rates

curl "https://allratestoday.com/api/v1/rates?source=USD&target=EUR" \
  -H "Authorization: Bearer YOUR_API_KEY"

[
  {
    "rate": 0.9215,
    "source": "USD",
    "target": "EUR",
    "time": "2026-04-03T12:00:00Z"
  }
]

Simple Rate

curl "https://allratestoday.com/api/rate?source=GBP&target=USD" \
  -H "Authorization: Bearer YOUR_API_KEY"

{ "rate": 1.2634, "source": "interbank" }

{
  "error": "A valid API key is required",
  "hint": "Get a free API key at https://allratestoday.com/register"
}

Convert

curl "https://allratestoday.com/api/v1/rates?source=USD&target=EUR&amount=1000" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "from": { "currency": "USD", "amount": 1000 },
  "to": { "currency": "EUR", "amount": 923.4 },
  "rate": 0.9234,
  "source": "interbank"
}

// JavaScript
const result = await client.convert('USD', 'EUR', 1000);
console.log(`$1,000 = €${result.result}`);  // $1,000 = €923.4

# Python
result = client.convert("USD", "EUR", 1000)
print(f"$1,000 = €{result['result']}")

Historical Rates

curl "https://allratestoday.com/api/historical-rates?source=USD&target=EUR&period=30d" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "source": "USD",
  "target": "EUR",
  "data": [
    { "date": "2026-03-04", "rate": 0.9198, "timestamp": 1741046400000 },
    { "date": "2026-03-05", "rate": 0.9210, "timestamp": 1741132800000 }
  ],
  "source_api": "interbank",
  "period": "30d"
}

Time Series & Custom Date Ranges

If you need an arbitrary from–to range, there are two supported routes:

1. Official rates over an exact range (recommended for reporting)

The central-bank history endpoint takes real from and to dates, returns one row per published date, and gives you a citable source and a fixed rate_date per row — which is what a report, an audit trail or a month-end close actually needs. It is a paid-plan endpoint and is billed per month of range.

curl "https://allratestoday.com/api/v1/central-bank/ecb/history?source=USD&target=EUR&from=2026-01-01&to=2026-03-31" \
  -H "Authorization: Bearer YOUR_API_KEY"

See Central Bank Rates for the full parameter list, and add &format=xlsx to get the range straight into a spreadsheet.

2. Mid-market series from a preset period

Take the nearest enclosing period and filter client-side. A quarter fits inside 30d only if it is the current month, so in practice this means 1y — which is weekly-sampled and costs 12 requests, so fetch it once and cache it rather than calling it per page view.

const res = await fetch(
  'https://allratestoday.com/api/historical-rates?source=USD&target=EUR&period=1y',
  { headers: { Authorization: `Bearer ${key}` } }
);
const { data, period } = await res.json();

// Confirm you got what you asked for — an unknown period silently becomes 7d.
if (period !== '1y') throw new Error(`Unexpected period: ${period}`);

const q1 = data.filter((p) => p.date >= '2026-01-01' && p.date <= '2026-03-31');

Symbols

curl "https://allratestoday.com/api/v1/symbols"

{
  "currencies": [
    { "code": "USD", "name": "US Dollar", "symbol": "$" },
    { "code": "EUR", "name": "Euro", "symbol": "€" },
    { "code": "GBP", "name": "British Pound", "symbol": "£" },
    { "code": "JPY", "name": "Japanese Yen", "symbol": "¥" },
    ...
  ],
  "count": 160
}

// JavaScript — build a currency dropdown
const data = await fetch('https://allratestoday.com/api/v1/symbols').then(r => r.json());
const options = data.currencies.map(c => ({
  value: c.code,
  label: `${c.code} — ${c.name}`,
}));

// React example
<select>
  {options.map(o => <option key={o.value} value={o.value}>{o.label}</option>)}
</select>

# Python
import requests
data = requests.get("https://allratestoday.com/api/v1/symbols").json()
for c in data["currencies"]:
    print(f"{c['code']}: {c['name']} ({c['symbol']})")

Central Bank Rates

Official exchange rates as published by central banks and national tax authorities — the rates required for tax filings, customs valuations, audits, and compliant invoicing. Coverage — 116 central banks and 3 tax authorities, plus the computed composite (120 sources in total). Use the Code column as the {bank} path parameter in the endpoints below.

See the central bank coverage map or the tax authority coverage for per-source pages, or get the live list from /api/v1/central-banks. Both kinds of source are served by the endpoints below — only the coverage pages are split. More sources are being added. All central-bank requests count toward your plan's monthly request quota, like every other endpoint.

These are not the mid-market rates served by /api/v1/rates and the conversion endpoints. A mid-market rate is the live interbank midpoint and moves every minute; an official rate is the number the named institution published for that date and never changes afterwards. Use official rates wherever a regulation, tax authority, or auditor names the source; use mid-market rates for pricing and display. The two can diverge by several percent — see the comparison in Overview.

Rates use the convention value = quote currency per 1 base currency and always carry the bank's own publication date (rate_date). On weekends and holidays the most recent published date is returned — which is the rate compliance rules require you to apply.

Every covered bank also has a dedicated zero-dependency npm package (e.g. ecb-exchange-rate, cbsl-exchange-rate) wrapping these endpoints with TypeScript types — linked from its per-bank page.

curl "https://allratestoday.com/api/v1/central-banks" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://allratestoday.com/api/v1/central-banks/rates?source=USD&target=EUR" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Full table
curl "https://allratestoday.com/api/v1/central-bank/cbsl/latest" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Single pair — USD to LKR at the CBSL rate
curl "https://allratestoday.com/api/v1/central-bank/cbsl/latest?source=USD&target=LKR" \
  -H "Authorization: Bearer YOUR_API_KEY"

{
  "bank": "cbsl",
  "name": "Central Bank of Sri Lanka",
  "rate_date": "2026-07-28",
  "source": "USD",
  "target": "LKR",
  "rate": 336.2512,
  "rate_type": "indicative",
  "derived": false,
  "method": "published",
  "disclaimer": "Official rates as published by the named central bank. On weekends/holidays the most recent published rate_date is returned."
}

{
  "bank": "cbsl",
  "name": "Central Bank of Sri Lanka",
  "rate_date": "2026-07-28",
  "rates": [
    { "base": "USD", "quote": "LKR", "type": "indicative", "value": 336.2512 },
    { "base": "EUR", "quote": "LKR", "type": "indicative", "value": 382.3849 }
  ]
}

curl "https://allratestoday.com/api/v1/central-bank/ecb/2026-06-30?source=USD&target=EUR" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://allratestoday.com/api/v1/central-bank/boc/history?symbol=USD&from=2026-01-01" \
  -H "Authorization: Bearer YOUR_API_KEY"

curl "https://allratestoday.com/api/v1/central-bank/cbsl/availability?year=2026" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response formats

All three central-bank table endpoints accept ?format=json|csv|xml|xlsx, like the rest of the API — see Response Formats for the full description. An xlsx export of a bank's history is the fastest way to hand a finance team an auditable range:

curl "https://allratestoday.com/api/v1/central-bank/ecb/history?source=USD&target=EUR&from=2026-01-01&format=xlsx" \
  -H "Authorization: Bearer YOUR_API_KEY" -o ecb-usd-eur.xlsx

Plan requirements

/latest, /availability and both /api/v1/central-banks… list endpoints work on every plan, free included. /history and the dated /{YYYY-MM-DD} lookup require a paid plan and return 403 on free:

{
  "error": "Historical central bank rates require a paid plan. The /latest endpoint is available on all plans.",
  "upgrade_url": "https://allratestoday.com/pricing"
}

Terminology

• rate_date — the bank's own publication date for the table, never ours. Requests for dates the bank didn't publish resolve to the most recent published date and carry published_on_requested_date: false.
• Value convention — value is always quote currency per 1 unit of base currency. Per-100/per-10,000 unit multipliers used by some banks (JPY, IDR) are already normalized away.
• rate_type — the bank's own price type, preserved as published: reference (single official rate), middle/mid (midpoint), indicative, or buy/sell where the bank publishes both sides (TCMB, BCB, BI, CBN, BCRP, CBBH). Banks publishing buy/sell return one row per side.
• derived + method — pairs the bank doesn't print directly are computed from its table (inverse or cross via the bank's home currency) and flagged derived: true; what the bank printed is never mixed with what was computed.
• Publication cadence — most covered banks publish one table per business day. The exceptions: the US Federal Reserve H.10 release is weekly (one rate per business day, released each Monday), the Swiss National Bank publishes monthly averages, UK HMRC publishes one table per calendar month, and the US Treasury one per quarter. The /availability endpoint shows any source's real calendar.

MCP Server

The @allratestoday/mcp-server package lets AI coding tools — Claude Code, Cursor, Claude Desktop, and ChatGPT Desktop — call the AllRatesToday API directly using the Model Context Protocol. Once configured, your assistant gets four new tools without any extra prompt engineering.

Install

claude mcp add allratestoday -- npx -y @allratestoday/mcp-server
claude mcp env allratestoday ALLRATES_API_KEY=art_live_xxxxx

{
  "mcpServers": {
    "allratestoday": {
      "command": "npx",
      "args": ["-y", "@allratestoday/mcp-server"],
      "env": { "ALLRATES_API_KEY": "art_live_xxxxx" }
    }
  }
}

Tools exposed

Environment variables

Example prompts

• "What's the USD to EUR rate right now?"
• "Show me GBP/JPY over the last 30 days."
• "Convert 2,500 USD to Indian rupees."
• "List every supported currency."
• "What's happening in FX markets today?"

Troubleshooting

• Client doesn't see the tools: restart the MCP client after editing config. Claude Desktop caches the server list.
• command not found: npx: install Node.js 18+ — npx ships with it.
• Auth-required tool failing: double-check your ALLRATES_API_KEY. Public tools work without one — test those first to confirm connectivity.

Full setup docs: /docs/mcp-server/. Source & issues: github.com/cahthuranag/mcp-server. Feature overview: /mcp/.

DeepSeek Integration

The Python package allratestoday-deepseek plugs AllRatesToday tools into any deepseek-chat or deepseek-reasoner conversation via OpenAI-compatible function calling.

pip install allratestoday-deepseek
export DEEPSEEK_API_KEY=sk-xxxxx
allratestoday-deepseek --ask "Convert 2500 USD to EUR."

from allratestoday_deepseek import DeepSeekCurrencyAgent

with DeepSeekCurrencyAgent() as agent:
    print(agent.ask("How many Japanese Yen is 500 Swiss Francs?"))

Same four tools as the MCP server, plus a dedicated convert_currency tool that fetches the pair rate and multiplies the amount. See the /deepseek/ landing page for details.

LLM Discovery

For browsing-enabled LLMs that don't use MCP or a Custom GPT, AllRatesToday publishes an llms.txt that tells agents exactly which endpoint to call for a live rate:

GET https://allratestoday.com/api/rate?source=USD&target=EUR
# Response: {"rate": 0.92145, "source": "interbank"}

This endpoint is public — no API key, no headers. It's safe to mention in user-facing prompts because it won't leak credentials.

Landing pages under /currency-converter/{from}-to-{to}-rate/ additionally expose a schema.org/ExchangeRateSpecification microdata block with the current rate, so LLM browsers can extract a numeric value without calling the API at all.

React Currency Localizer

Automatically display prices in your user's local currency using IP geolocation. Zero runtime dependencies, intelligent caching, and graceful fallbacks.

npm install react-currency-localizer-realtime

How It Works

useCurrencyConverter()

import { useCurrencyConverter } from 'react-currency-localizer-realtime';

function ProductPrice({ price }) {
  const { convertedPrice, localCurrency, isLoading, error } = useCurrencyConverter({
    basePrice: price,
    baseCurrency: 'USD',
    apiKey: 'YOUR_API_KEY',
  });

  if (isLoading) return <span>Loading...</span>;
  if (error) return <span>${price}</span>; // Fallback

  return (
    <span>
      {new Intl.NumberFormat(undefined, {
        style: 'currency',
        currency: localCurrency || 'USD',
      }).format(convertedPrice || price)}
    </span>
  );
}

useCurrencyLocalizer() — Batch Conversion

import { useCurrencyLocalizer } from 'react-currency-localizer-realtime';

function ProductList({ products }) {
  const { convertAndFormat, isReady } = useCurrencyLocalizer({
    baseCurrency: 'USD',
    apiKey: 'YOUR_API_KEY',
  });

  return (
    <ul>
      {products.map(p => (
        <li key={p.id}>
          {p.name}: {isReady ? convertAndFormat(p.price) : '...'}
        </li>
      ))}
    </ul>
  );
}

function PricingTable() {
  const plans = [
    { name: 'Basic', price: 9.99 },
    { name: 'Pro', price: 19.99 },
    { name: 'Enterprise', price: 49.99 },
  ];

  const { convertAndFormat, isReady } = useCurrencyLocalizer({
    baseCurrency: 'USD',
    apiKey: 'YOUR_API_KEY',
  });

  return (
    <div>
      {plans.map(plan => (
        <div key={plan.name}>
          <h3>{plan.name}</h3>
          <p>{isReady ? convertAndFormat(plan.price) : '...'}/month</p>
        </div>
      ))}
    </div>
  );
}

<LocalizedPrice /> Component

import { LocalizedPrice } from 'react-currency-localizer-realtime';

// Keyless — auto-detects currency, free daily ECB rates, shows fallback on error
<LocalizedPrice basePrice={99.99} baseCurrency="USD" />

// With a key — real-time rates, 160+ currencies
<LocalizedPrice basePrice={99.99} baseCurrency="USD" apiKey="YOUR_API_KEY" />

// Custom formatting for subscription pricing
<LocalizedPrice
  basePrice={19.99}
  baseCurrency="USD"
  apiKey="YOUR_API_KEY"
  formatPrice={(price, currency) => `${currency} ${price.toFixed(2)}/month`}
/>

<LocalizedPrice
  basePrice={99.99}
  baseCurrency="USD"
  apiKey="YOUR_API_KEY"
  loadingComponent={<span>Converting...</span>}
  errorComponent={(error, basePrice) => (
    <span>${basePrice} <small>(conversion unavailable)</small></span>
  )}
/>

function CurrencySelector() {
  const [currency, setCurrency] = useState('');

  return (
    <div>
      <select value={currency} onChange={e => setCurrency(e.target.value)}>
        <option value="">Auto-detect</option>
        <option value="USD">USD</option>
        <option value="EUR">EUR</option>
        <option value="GBP">GBP</option>
        <option value="JPY">JPY</option>
      </select>

      <LocalizedPrice
        basePrice={99.99}
        baseCurrency="USD"
        apiKey="YOUR_API_KEY"
        manualCurrency={currency || undefined}
      />
    </div>
  );
}

const [isClient, setIsClient] = useState(false);
useEffect(() => setIsClient(true), []);

<LocalizedPrice
  basePrice={99.99}
  baseCurrency="USD"
  apiKey="YOUR_API_KEY"
  manualCurrency={!isClient ? 'USD' : undefined}
/>

Errors

Every error is a JSON object with an error string, and sometimes a hint or extra context. The shape never changes with the status code, so one handler covers all of them.

{ "error": "Authentication required. Provide an API key via Authorization header or log in." }

A handler that covers all of them

async function getRate(from, to) {
  const res = await fetch(
    `https://allratestoday.com/api/v1/rates?source=${from}&target=${to}`,
    { headers: { Authorization: `Bearer ${process.env.ART_API_KEY}` } }
  );

  if (res.ok) return (await res.json())[0].rate;

  const { error } = await res.json().catch(() => ({ error: res.statusText }));

  switch (res.status) {
    case 400:
    case 404:
      throw new Error(`Bad FX request: ${error}`);      // a bug — fix the call
    case 401:
    case 403:
      throw new Error(`FX credentials: ${error}`);       // page someone
    case 429:
      return cache.get(`${from}${to}`);                  // quota gone; serve stale
    default:
      return retryWithBackoff(() => getRate(from, to)); // 5xx — transient
  }
}

Whatever you do with an error, keep a last-known-good rate. FX is a dependency in a payment path; failing a checkout because a rate lookup returned 502 is almost never the right trade.

Response Formats

Every table endpoint returns JSON by default and accepts ?format= with one of json, csv, xml or xlsx. The rows are identical in every format — only the encoding changes.

Supported on: /api/v1/rates, /api/v1/symbols, /api/historical-rates, /api/v1/central-banks, and the central-bank /latest, /history and /availability endpoints.

curl "https://allratestoday.com/api/v1/central-bank/ecb/history?source=USD&target=EUR&from=2026-01-01&format=xlsx" \
  -H "Authorization: Bearer YOUR_API_KEY" -o ecb-usd-eur.xlsx

• An unsupported value returns 400 before authentication is checked, so a typo in format never looks like an auth failure — and never costs a request.
• format is ignored when amount is used on /api/v1/rates: a conversion is a single object, not a table, and always comes back as JSON.
• A non-JSON response is still charged against your quota exactly once, and an xlsx of a year of history is billed by range like any other history call.
• Each coverage page also offers its published table as a one-click Excel or CSV download with no API key at all — see any central bank or tax authority page.

Caching

Rates are quoted per request, so the cheapest integration is one that does not call us for every page view. Caching is the single biggest lever on your quota.

Only cache a rate as far as your use allows: for display, a minute is invisible; for a booked transaction, store the exact time and rate you used, and never re-derive a historical figure from a cached live rate.

CORS & Browser Use

These endpoints send Access-Control-Allow-Origin: * and are callable cross-origin from a browser:

/api/v1/rates, /api/historical-rates and every /api/v1/central-bank/… path do not send permissive CORS headers; a cross-origin fetch to them from a third-party site is blocked by the browser.

But CORS is not the real objection, and /api/rate being callable from a browser is not an invitation to do it: a key in browser JavaScript is a public key. Anyone can read it from the network tab and spend your quota. Call the API from your server and expose your own endpoint to your frontend:

// server.js — your backend holds the key
app.get('/fx/:from/:to', async (req, res) => {
  const r = await fetch(
    `https://allratestoday.com/api/v1/rates?source=${req.params.from}&target=${req.params.to}`,
    { headers: { Authorization: `Bearer ${process.env.ART_API_KEY}` } }
  );
  res.set('Cache-Control', 'public, max-age=60').json(await r.json());
});

If you genuinely need rates in a page with no backend, the supported options are the embeddable widget and the keyless React Currency Localizer, both of which are built for it. For a marketing page or a dashboard, those are usually the right answer.

Versioning & Changes

The API is versioned in the path. /api/v1/… is the current and only version; v1 paths will not change shape underneath you.

• Additive changes ship without notice. New fields, new endpoints, new central banks and new format values can appear at any time. Parse defensively: ignore fields you do not recognise rather than validating against a closed schema, and do not assume a fixed number of keys in a response object.
• Breaking changes get a new version path and an email to every account using the affected endpoint before the old one is retired.
• Legacy unversioned paths — /api/rate and /api/historical-rates — remain supported. New integrations should prefer the /api/v1/ equivalents where one exists.
• Retired: the keyless /api/public/rates now returns 401 with a pointer to registration. If you are still calling it, move to /api/v1/rates with a free key.

The machine-readable contract is the OpenAPI specification — generate a client from it rather than hand-writing one. Coverage and behaviour are also published as a versioned PDF on the API specifications page, which is the document to hand an auditor or a procurement team.

Service Availability

Current system health, historical uptime, and incident reports are published on our status page:

status.allratestoday.com →

• Live status for the website, authenticated rates API, API documentation, and pricing & billing, updated automatically by independent monitoring.
• Historical daily uptime records per component — the 99.9% figure on our homepage is measured, not promised.

Planned maintenance is announced in advance on the status page. During an incident, check there first — it is hosted separately from the API, so it stays up even if the API does not.

Data Freshness

AllRatesToday provides real-time exchange rates sourced from institutional-grade forex data providers including institutional interbank market data. Unlike other providers that update once every 60 minutes, our rates are fetched live on every request, ensuring you always get the most current mid-market rates available.

This section describes the mid-market endpoints. Official central-bank and tax-authority rates follow the publisher's calendar instead — one table per day, week, month, or quarter, fixed once published. See Central Bank Rates and the comparison in Overview.

Supported Currencies

160 currencies, including:

See the full list of all supported currencies with codes, names, and symbols. Also available via the OpenAPI specification. Prefer clicking around? Try every endpoint live in the API Playground.

Official SDKs

Install our official SDK for your language. All SDKs support free and authenticated endpoints, currency conversion, and historical rates.

JavaScript / TypeScript (npm)

npm install @allratestoday/sdk

import AllRatesToday from '@allratestoday/sdk';

const client = new AllRatesToday({ apiKey: 'art_live_...' });

// Get latest rates (multiple currencies in one call)
const { rates } = await client.latest({ base: 'USD', symbols: ['EUR', 'GBP', 'JPY'] });
console.log(rates); // { EUR: 0.9234, GBP: 0.7891, JPY: 151.42 }

// Convert an amount
const result = await client.convert('USD', 'EUR', 1000);
console.log(`$1,000 = €${result.result}`);

// Historical conversion at a specific date
const past = await client.convert('USD', 'EUR', 1000, { date: '2026-01-15' });

// Rates for a specific date
const data = await client.forDate('2026-01-15', { base: 'EUR', symbols: ['USD', 'GBP'] });

// Time series (custom date range)
const series = await client.timeSeries('2026-01-01', '2026-03-31', {
  base: 'USD', symbols: ['EUR']
});

// List all supported currencies
const { symbols } = await client.symbols();
console.log(symbols); // { USD: 'United States Dollar', EUR: 'Euro', ... }

// Historical rates by period
const history = await client.getHistoricalRates('USD', 'EUR', '30d');

Python (pip)

pip install allratestoday

from allratestoday import AllRatesToday

client = AllRatesToday(api_key="art_live_...")

# Get exchange rate
rate = client.get_rate("USD", "EUR")
print(f"1 USD = {rate['rate']} EUR")

# Convert amount
result = client.convert("USD", "EUR", 1000)
print(f"$1,000 = €{result['result']}")

# Historical rates
history = client.get_historical_rates("USD", "EUR", "30d")

PHP (Composer)

composer require allratestoday/sdk

use AllRatesToday\AllRatesToday;

$client = new AllRatesToday('art_live_...');

// Get exchange rate
$rate = $client->getRate('USD', 'EUR');
echo "1 USD = {$rate['rate']} EUR";

// Convert amount
$result = $client->convert('USD', 'EUR', 1000);
echo "$1,000 = €{$result['result']}";

// Historical rates
$history = $client->getHistoricalRates('USD', 'EUR', '30d');

React (npm)

npm install react-currency-localizer-realtime

import { LocalizedPrice } from 'react-currency-localizer-realtime';

// Automatically detects the visitor's currency. No API key needed:
// keyless mode uses free daily ECB rates (~30 currencies) and renders
// a "Rates by AllRatesToday" link. Pass apiKey for real-time + 160 currencies.
function PricingCard() {
  return (
    <div>
      <h3>Pro Plan</h3>
      <LocalizedPrice basePrice={19.99} baseCurrency="USD" />
    </div>
  );
}

import { useCurrencyConverter } from 'react-currency-localizer-realtime';

// Hook-based API for full control
function ProductPrice({ price }) {
  const { convertedPrice, localCurrency, isLoading } = useCurrencyConverter({
    basePrice: price,
    baseCurrency: 'USD',
    apiKey: 'art_live_...',
  });

  if (isLoading) return <span>Loading...</span>;

  return (
    <span>
      {new Intl.NumberFormat(undefined, {
        style: 'currency',
        currency: localCurrency || 'USD',
      }).format(convertedPrice || price)}
    </span>
  );
}

import { useCurrencyLocalizer } from 'react-currency-localizer-realtime';

// Batch conversion for product lists
function ProductList({ products }) {
  const { convertAndFormat, isReady } = useCurrencyLocalizer({
    baseCurrency: 'USD',
    apiKey: 'art_live_...',
  });

  return (
    <ul>
      {products.map(p => (
        <li key={p.id}>{p.name}: {isReady ? convertAndFormat(p.price) : '...'}</li>
      ))}
    </ul>
  );
}

Code Examples (without SDK)

JavaScript / Node.js

const response = await fetch(
  'https://allratestoday.com/api/v1/rates?source=USD&target=EUR',
  { headers: { 'Authorization': 'Bearer YOUR_API_KEY' } }
);
const data = await response.json();
console.log(`1 USD = ${data.rate} EUR`);

Python

import requests

response = requests.get(
    'https://allratestoday.com/api/v1/rates',
    params={'source': 'USD', 'target': 'EUR'},
    headers={'Authorization': 'Bearer YOUR_API_KEY'}
)
data = response.json()
print(f"1 USD = {data['rate']} EUR")

PHP

$opts = {'http' => {'header' => 'Authorization: Bearer YOUR_API_KEY'}};
$context = stream_context_create($opts);
$response = file_get_contents(
    'https://allratestoday.com/api/v1/rates?source=USD&target=EUR',
    false, $context
);
$data = json_decode($response, true);
echo "1 USD = " . $data['rate'] . " EUR";

cURL

curl "https://allratestoday.com/api/v1/rates?source=USD&target=EUR" \
  -H "Authorization: Bearer YOUR_API_KEY"

API Playground

Try the API directly from your browser. Enter your API key to test.

Click "Send Request" to see the live response...

Run in Postman

Fork our Postman collection to quickly test all API endpoints.