ForexFeed

Authentication

Every API request is authenticated with an API key created in your dashboard. Keys look like ff_live_ followed by 48 hex characters.

Sending your key

Preferred: the Authorization header.

curl "https://forex-feed.com/api/v1/latest" \
  -H "Authorization: Bearer ff_live_YOUR_KEY"

A bare key in the header (without Bearer) also works, as does a query parameter for quick tests — though avoid the query form in production, since URLs end up in logs:

curl "https://forex-feed.com/api/v1/latest?api_key=ff_live_YOUR_KEY"

How keys are stored

We store only a SHA-256 hash of your key. The full key is shown exactly once at creation and cannot be recovered afterwards — if it's lost, revoke it and create a new one.

Rotation & revocation

  • • Revocation is immediate — a revoked key fails its next request.
  • • To rotate: create a new key, deploy it, then revoke the old one.
  • • Plans include multiple keys (Developer: 3, Unlimited: 10) so rotation never needs downtime.

Common mistakes

  • • Missing the Bearer prefix in the Authorization header.
  • • Calling the API before confirming your account email (keys can't be created until it's confirmed).
  • • Shipping the key in client-side code — call the API from your backend and keep the key server-side.