The answers, without the tour.

Every response is served from our own store, so a call never waits on an upstream provider. Two timestamps come with each one: when we read the rates, and when the source itself last published them. They are shown separately because re-reading an unchanged source makes a newer fetch, not fresher rates — if the source has not republished, the response says so rather than implying a live quote. The status page reports both, plus how old the stored reading is.

The full catalogue we publish — the major pairs, regional currencies and the long tail — with each code's official name, symbol and flag metadata returned alongside its rate.

No — the open endpoint answers anyone, with no account and no card. It is limited to 5 a second, 50 an hour and 50 a day, because it costs us nothing to let you try before you sign up. A key removes every one of those limits.

Yes, and all of it. Every reading we take is kept, and a keyed call can reach any part of that record with ?from= and ?to= dates, or pull the most recent 2,000 readings with ?snapshots=. History is served from our own store, so a wide range answers just as fast as a narrow one. The open endpoint stays current-only — history is the one thing reserved for accounts.

Every new account opens with a signup bonus of 5,000 requests. Nothing is charged, nothing expires, and it is never quietly reduced — every key you make draws from that same balance. If you ever work through it, a one-time pack tops it back up, and the requests are yours for as long as the account exists.

A spent window answers 429 with a machine-readable code, the window that was reached and the number of seconds until it frees. The open endpoint is limited per client to 5 a second, 50 an hour and 50 a day; a key is capped on bursts at 20 a second and 2,000 an hour per key, with no daily cap, and its volume is bounded by your balance. A refused call spends nothing from that balance.

Keys are generated with a cryptographically secure random source and shown to you once. Only a one-way digest is retained, so a copy of the database cannot be used to call the API. Revoke a key at any time and it stops working immediately.

Yes. Responses are plain JSON with permissive CORS headers. Keep your key on a server you control — a key in client-side code is visible to anyone who loads the page.