No eligible rate right now

Exchange-rate data forAI agents

Give your agent anonymous, claimable access to real-time Ethiopian bank exchange rates over a small, open protocol. No human account to start — discover the endpoints, fetch a token, and read the latest rates. Free by default.

Discover the protocol Pricing

Search these details

How it works

The anonymous path mirrors the OAuth 2.0 JWT bearer grant (RFC 7523): an anonymous identity, an identity assertion exchanged for a Bearer token. An optional claim ceremony (like OAuth device authorization) lets a human bind their email to the agent. Every URL below is served by the API host you are configured against.

1 · Discover

Read the metadata

Fetch https://exchange.et/.well-known/oauth-authorization-server to learn the exact endpoints, grant types, and the AUTH.md recipe.

2 · Identify

Anonymous identity

POST https://api.exchange.et/api/v1/agent/identity. You get a signed identity_assertion (a short-lived JWT) for the token endpoint.

3 · Token

Get a Bearer token

POST https://api.exchange.et/api/v1/oauth2/token with the jwt-bearer grant to exchange your assertion for an access token.

4 · Claim (optional)

Link an email

Start a claim ceremony and print the user_code — a human confirms it at /agent/claim to own the agent.

Discover the protocol

Like an OAuth 2.0 authorization server, the API publishes its metadata at the RFC 8414 well-known location. Your agent should always read this document instead of hardcoding endpoints — it is the source of truth and may change.

curl https://exchange.et/.well-known/oauth-authorization-server

curl -s https://exchange.et/.well-known/oauth-authorization-server | jq .

The metadata advertises:

token_endpoint — where to exchange an identity assertion or approved claim for a Bearer token
agent_auth.identity_endpoint — where to resolve an anonymous identity or start a claim ceremony
agent_auth.claim_endpoint — where an agent starts a claim ceremony (the human confirms on this site at /agent/claim)
service_documentation — the AUTH.md recipe (below)

{
  "issuer": "https://exchange.et",
  "token_endpoint": "https://api.exchange.et/api/v1/oauth2/token",
  "revocation_endpoint": "https://api.exchange.et/api/v1/oauth2/revoke",
  "x_standards_profile": "RFC 8414-style discovery for the exchange.et agent-auth JWT-bearer-only profile — not a full OAuth 2.0 authorization server. No authorization_endpoint and no authorization-code / implicit response_type flow exist; the jwt-bearer and claim grants are exchanged directly at the token endpoint, so response_types_supported is intentionally omitted.",
  "scopes_supported": ["rates:read"],
  "token_endpoint_auth_methods_supported": ["none"],
  "revocation_endpoint_auth_methods_supported": ["none"],
  "grant_types_supported": [
    "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "urn:workos:agent-auth:grant-type:claim"
  ],
  "service_documentation": "https://exchange.et/auth.md",
  "agent_auth": {
    "identity_endpoint": "https://api.exchange.et/api/v1/agent/identity",
    "claim_endpoint": "https://api.exchange.et/api/v1/agent/identity/claim",
    "identity_types_supported": ["anonymous", "identity_assertion", "service_auth"],
    "events_supported": ["agent_registered", "agent_claimed", "credential_revoked"],
    "signing": "HS256 self-issued (symmetric AGENT_AUTH_SECRET); no public JWKS keys",
    "claim_ttl_seconds": 1800,
    "assertion_ttl_seconds": 3600,
    "access_token_ttl_seconds": 21600
  }
}

The AUTH.md recipe

The API publishes AUTH.md — a plain Markdown document that agents can curl and follow step by step. It is the same flow documented on this page, but machine-friendly and kept in lockstep with the backend. Treat it as the canonical recipe.

Fetch the recipe from the service_documentation URL advertised in the metadata (currently https://exchange.et/auth.md), or follow the interactive flow below. The recipe works for both scripts and humans.

Fetch the recipe

curl -s https://exchange.et/auth.md

Anonymous quick start

Three calls and your agent can read real-time rates. No email, no API key dashboard — just an anonymous identity.

Step 1

Create an anonymous identity

Resolve an anonymous identity. The response is a signed identity_assertion — a short-lived JWT your agent stores and presents at the token endpoint. The supported identity types are advertised by the discovery document.

POST https://api.exchange.et/api/v1/agent/identity

curl -X POST https://api.exchange.et/api/v1/agent/identity \
  -H 'Content-Type: application/json' \
  -d '{"identity_type": "anonymous", "scope": "rates:read"}'

{
  "identity_type": "anonymous",
  "identity_assertion": "eyJhbGciOiJIUzI1NiIs...",
  "expires_in": 3600,
  "issuer": "https://exchange.et",
  "scope": "rates:read",
  "token_endpoint": "https://api.exchange.et/api/v1/oauth2/token"
}

Step 2

Exchange for a Bearer token

Exchange the identity assertion for a short-lived Bearer access token using the jwt-bearer grant. The token is minted directly for anonymous identities — no human approval. Treat the token like a password.

POST https://api.exchange.et/api/v1/oauth2/token

curl -X POST https://api.exchange.et/api/v1/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' \
  -d 'assertion=<identity_assertion>'

{
  "access_token": "et_live_...",
  "token_type": "Bearer",
  "expires_in": 21600,
  "scope": "rates:read",
  "tier": "free"
}

The identity and token endpoints are rate-limited to 20 requests/hour per IP — cache the token and reuse it instead of minting one on every call.

Step 3

Read the latest rates

Send the token on the standard public endpoints — exactly like a regular API key.

Use the Bearer token

curl -s 'https://exchange.et/api/v1/latest-rates' \
  -H 'Authorization: Bearer <access_token>' | jq .

The claim ceremony

Agents are anonymous by default. When you want a person to own the agent — to manage it, recover it, or tie it to an account — that person claims it with the user code the agent prints.

1Agent starts a ceremony

Requesting a service_auth identity returns a short-lived user_code and a verification URL. The agent displays them:

POST https://api.exchange.et/api/v1/agent/identity

curl -X POST https://api.exchange.et/api/v1/agent/identity \
  -H 'Content-Type: application/json' \
  -d '{"identity_type": "service_auth", "login_hint": "you@example.com"}'

Claim me at https://exchange.et/agent/claim?code=K7XQ-9MNP

2Human confirms

The owner opens exchange.et/agent/claim, enters the code and their email, and confirms.

Go to the claim page

3Agent mints its token

The user_code is valid for a short window (see the claim TTL in the metadata), so only the person holding it can claim the agent. After approval the agent exchanges its claim_token at the token endpoint (claim grant) to mint its access token.

POST https://api.exchange.et/api/v1/oauth2/token

curl -X POST https://api.exchange.et/api/v1/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:workos:agent-auth:grant-type:claim' \
  -d 'claim_token=<claim_token>' \
  -d 'user_code=<user_code>'

Claiming is optional. An agent that is never claimed continues to work anonymously on the Free tier with no personal data attached.

Revocation

You can stop an agent at any time. Access tokens expire after a few hours, but revoke immediately if a token leaks.

Short-lived by default

Access tokens are minted with a short expires_in (6 hours), so a leaked token stops working on its own within hours. Your agent stores its identity assertion and can mint a fresh token whenever it needs one.

Revoke before expiry

The discovery document advertises a revocation_endpoint (https://api.exchange.et/api/v1/oauth2/revoke). Call it with the access token to revoke immediately. Claimed agents can also be revoked from the owner's account. For anything else, email support@keydama.com with the agent's identity details.

POST https://api.exchange.et/api/v1/oauth2/revoke

curl -X POST https://api.exchange.et/api/v1/oauth2/revoke \
  -H 'Content-Type: application/json' \
  -d '{"token": "<access_token>"}'

Renewal: assertions and tokens lapse

Both credentials are short-lived, so a long-running agent must renew before they expire — never after a 401.

Roll the assertion forward

The identity assertion lasts 1 hour and the access token 6 hours. Before the assertion expires, present it back to mint a fresh one:

POST https://api.exchange.et/api/v1/agent/identity

curl -X POST https://api.exchange.et/api/v1/agent/identity \
  -H 'Content-Type: application/json' \
  -d '{"identity_type": "identity_assertion", "id_jag": "<current assertion>"}'

Re-mint before expiry

Exchange each fresh assertion for a new access token via the jwt-bearer grant. Once an assertion has already expired it cannot be rolled forward — mint a new anonymous identity (or restart the claim ceremony) and exchange again. Cache the token and re-mint a short safety margin before expires_in elapses.

Honest by default: Free tier first

Agents start on the Free tier at no cost — real-time latest rates, no API key dashboard required. Upgrade only when you actually need more.

Free (default): real-time latest rates with a per-hour request budget — enough for most personal and evaluation agents.
Pro, Growth, Enterprise: higher rate limits, full historical data, and currency conversion — see pricing for current tiers.

Compare plans Human API keys

Frequently asked questions

Does my agent need an account or email to start?

No. The anonymous flow — create an identity, get a token — needs no email or dashboard sign-up. The claim ceremony (email) is optional and only links an owner to the agent.

Why discover endpoints instead of hardcoding them?

The API may move or add capabilities over time. The /.well-known/oauth-authorization-server document is the authoritative source; reading it keeps your agent working across deployments and upgrades. The AUTH.md recipe is the companion walkthrough.

What does claiming do?

Claiming binds your email to the agent identity, so the agent is tied to a person who can manage or revoke it. It does not change how the agent reads rates — that stays on its Free tier unless you upgrade.

What if an agent is compromised?

Access tokens expire after a few hours, but if a token or identity assertion leaks, revoke promptly: use the advertised revocation endpoint, revoke from your account for claimed agents, or contact support with the agent's identity details. Your stored identity assertion is the agent's credential — protect it like a password.

How do I get more than the Free tier?

Upgrade on the pricing page. Paid tiers raise rate limits and unlock historical data and conversion.

Ready to connect your agent?

Your configured API host is api.exchange.et. Start at the metadata document or send your agent to the claim page.

/.well-known/oauth-authorization-server Claim page

{ "issuer": "https://exchange.et", "token_endpoint": "https://api.exchange.et/api/v1/oauth2/token", "revocation_endpoint": "https://api.exchange.et/api/v1/oauth2/revoke", "x_standards_profile": "RFC 8414-style discovery for the exchange.et agent-auth JWT-bearer-only profile — not a full OAuth 2.0 authorization server. No authorization_endpoint and no authorization-code / implicit response_type flow exist; the jwt-bearer and claim grants are exchanged directly at the token endpoint, so response_types_supported is intentionally omitted.", "scopes_supported": ["rates:read"], "token_endpoint_auth_methods_supported": ["none"], "revocation_endpoint_auth_methods_supported": ["none"], "grant_types_supported": [ "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:workos:agent-auth:grant-type:claim" ], "service_documentation": "https://exchange.et/auth.md", "agent_auth": { "identity_endpoint": "https://api.exchange.et/api/v1/agent/identity", "claim_endpoint": "https://api.exchange.et/api/v1/agent/identity/claim", "identity_types_supported": ["anonymous", "identity_assertion", "service_auth"], "events_supported": ["agent_registered", "agent_claimed", "credential_revoked"], "signing": "HS256 self-issued (symmetric AGENT_AUTH_SECRET); no public JWKS keys", "claim_ttl_seconds": 1800, "assertion_ttl_seconds": 3600, "access_token_ttl_seconds": 21600 } }

{ "identity_type": "anonymous", "identity_assertion": "eyJhbGciOiJIUzI1NiIs...", "expires_in": 3600, "issuer": "https://exchange.et", "scope": "rates:read", "token_endpoint": "https://api.exchange.et/api/v1/oauth2/token" }

curl -X POST https://api.exchange.et/api/v1/oauth2/token \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer' \ -d 'assertion=<identity_assertion>'

curl -X POST https://api.exchange.et/api/v1/oauth2/token \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=urn:workos:agent-auth:grant-type:claim' \ -d 'claim_token=<claim_token>' \ -d 'user_code=<user_code>'

Exchange-rate data forAI agents

How it works

Read the metadata

Anonymous identity

Get a Bearer token

Link an email

Discover the protocol

The AUTH.md recipe

Anonymous quick start

Create an anonymous identity

Exchange for a Bearer token

Read the latest rates

The claim ceremony

1Agent starts a ceremony

2Human confirms

3Agent mints its token

Revocation

Short-lived by default

Revoke before expiry

Renewal: assertions and tokens lapse

Roll the assertion forward

Re-mint before expiry

Honest by default: Free tier first

Frequently asked questions

We value your privacy

Exchange-rate data forAI agents

How it works

Read the metadata

Anonymous identity

Get a Bearer token

Link an email

Discover the protocol

The AUTH.md recipe

Anonymous quick start

Create an anonymous identity

Exchange for a Bearer token

Read the latest rates

The claim ceremony

1Agent starts a ceremony

2Human confirms

3Agent mints its token

Revocation

Short-lived by default

Revoke before expiry

Renewal: assertions and tokens lapse

Roll the assertion forward

Re-mint before expiry

Honest by default: Free tier first

Frequently asked questions