API and Integration Layer for Connected Exchange Offices
ForexFox exposes a documented REST API that external systems can consume without modification. The public rates endpoint requires no authentication. Partner integrations use scoped API keys with IP filtering, rate limits, and expiration. Internal workflows use JWT. Both patterns coexist on the same backend.
# Public rates — no authentication
curl https://api.forexfox.eu/api/rates/public \
-H "X-API-Key: ff_live_9f2c…" \
-H "Authorization: Bearer <JWT>"Key technical highlights
Public rates endpoint: available without authentication, returns official rates with buy/sell margins by client type.
Source-based rate ingestion: FloatRates adapter included, extensible to additional providers via the base adapter interface.
API key features: scope, allowed IP list (JSON), rate_limit_per_minute, expiration date, usage counter (total_requests), last_used_at tracking.
Dual authentication: JWT Bearer for internal sessions, X-API-Key for partner integrations — both supported natively.
Key lifecycle: create, list, update, revoke (soft disable), delete, verify — full governance without code changes.
Admin-triggered rate refresh: source-based update endpoint lets admins pull latest rates on demand without restart.
A public rates endpoint that requires no credentials
External systems — pricing portals, exchange rate displays, partner comparison tools — can consume ForexFox rates without requesting an API key. The public endpoint returns official rates alongside calculated buy and sell prices for each active currency, derived from the margin profiles configured in the system. This makes it practical to embed live ForexFox pricing in customer-facing channels within minutes of initial setup, without any authentication overhead.
Scoped API keys with operational safeguards
Each API key carries a scope that limits which resources it can access. IP filtering restricts the key to a declared list of allowed source addresses, preventing use from unauthorized environments. A rate_limit_per_minute cap protects the backend from integration misconfiguration or abuse. Keys track total_requests and last_used_at, giving administrators the data they need to identify stale integrations, audit usage patterns, and enforce key rotation policies without waiting for incidents.
JWT and X-API-Key: dual authentication in one backend
ForexFox natively supports two authentication patterns on the same API surface. Operator-facing web applications authenticate with JWT Bearer tokens issued at login. External systems and machine-to-machine integrations use X-API-Key headers. Both patterns coexist without routing changes, meaning a single ForexFox deployment can serve internal front-office users and external partner integrations simultaneously, with each path enforcing its own access controls.
Extensible rate ingestion with source-based refresh
The rate ingestion layer is built around a base adapter interface. The FloatRates provider is included out of the box. Connecting a new rate source means implementing the adapter contract and registering the provider name — no changes to the core API. Admins can trigger a refresh from any configured source on demand through the update endpoint, without a system restart. The full rate history is stored per source and per effective date, so every pricing decision can be traced back to the exact data feed it used.
Use cases by role
One platform, benefits tailored to each role.
Integration Engineer
Connect downstream systems to reliable, near real-time FX data with minimal setup.
- Consume the public rates endpoint for pricing portals, signage feeds, or rate comparison tools without requesting credentials.
- Authenticate partner systems with a scoped API key that restricts access to specific resources.
- Use X-API-Key headers for machine-to-machine integrations and JWT for operator-facing web apps — both work on the same API.
- Retrieve the full official rate history from /api/rates/admin/all for backfill or analytics pipelines.
IT Administrator
Control and audit all external API access from one administration surface.
- Issue API keys with explicit scope, IP allow-list, expiration date, and per-minute rate limit.
- Revoke keys immediately on security events without affecting other integrations.
- Monitor total_requests and last_used_at per key to detect stale or anomalous usage.
- Verify a key's validity and scope without exposing the secret to the requesting team.
Operations Manager
Keep rate data fresh without waiting for scheduled jobs or system restarts.
- Trigger a rate refresh from a specific provider on demand through the admin update endpoint.
- Configure multiple rate sources and switch between them without code deployment.
- Use the rate history endpoint to audit what rate was applied on a given day.
- Validate that external pricing tools are reading current rates by checking last_used_at on the integration key.
Related APIs
Public rates feed
No-authentication endpoint returning live rates with buy/sell spreads for all active currencies.
Full rate history (admin)
Complete official rate history for all currencies, for audit and analytics consumption.
Source-based rate refresh
Admin-triggered pull of latest rates from a named external provider.
API key management
Full lifecycle: create, list, update, revoke, delete, and verify API keys with scope and IP controls.
API key revocation
Soft-disable a key immediately while preserving its usage history.
Talk to a ForexFox specialist
See how this solution fits your operational constraints and compliance requirements.