# News API Currents

> Build a secure Currents News API backend in OpenHands without exposing the owner key. Use when adding Currents latest-news or search to an end-user product.

- Skill: `currentslab/news-api-currents-5` (Agent Skill)
- Install (CLI): `npx skillmds@latest add currentslab/news-api-currents-5`
- Raw SKILL.md: https://api.skillmd.com/api/skills/currentslab/news-api-currents-5/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: currentslab (https://skillmd.com/u/currentslab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/currentslab/news-api-currents-5

---


# Currents Owner Interface (OpenHands)

## Trigger
Use when a user wants Currents-powered news in an OpenHands workflow without exposing the owner API key to end users.

## Requirements
- Backend service with outbound internet access
- Runtime env var: `CURRENTS_API_KEY`

## Need an API key?
If you do not have a Currents API key yet, register here:
- https://currentsapi.services/en/register

## Steps
1. Accept requests in your backend only.
2. Validate and allowlist request params before forwarding.
3. Call Currents v2 endpoints:
   - `https://api.currentsapi.services/v2/latest-news`
   - `https://api.currentsapi.services/v2/search`
4. Authenticate with `Authorization: Bearer ${CURRENTS_API_KEY}`.
5. Enforce quotas, caching, retries, and rate limits.
6. Return a normalized response schema to callers.

## Date filtering (UTC+0)
- Send `start_date` and `end_date` as RFC3339 / ISO-8601.
- Convert user-local input times to UTC (`Z`) before requesting.
- Treat returned `published` timestamps as UTC (`+0000`).
- Use half-open windows (`>= start`, `< end`) to avoid duplicate boundary results.

## Pitfalls
- Exposing owner keys in browser/mobile clients.
- Forwarding unvalidated query params.
- Skipping rate limits or cache.
- Using default Python urllib `User-Agent`, which can trigger Cloudflare/WAF blocks (`403`, code `1010`).

## Verification
- Key is absent from client-visible artifacts.
- Page size is bounded and filters are validated.
- Logs redact secret values.
- Backend requests send an explicit browser/curl-like `User-Agent`.