# News API Currents

> Build a secure backend proxy for Currents News API without exposing the owner key. Use when adding Currents latest-news or search to an end-user product.

- Skill: `currentslab/news-api-currents-6` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add currentslab/news-api-currents-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/currentslab/news-api-currents-6/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: currentslab (https://skillmd.com/u/currentslab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/currentslab/news-api-currents-6

---


# Currents Owner Interface (Portable)

## Trigger
Use when a user asks to expose Currents data to end users while keeping owner credentials private.

## Requirements
- Backend service with outbound internet
- Runtime env var: `CURRENTS_API_KEY`

## Need an API key?
If you do not have a Currents API key yet, register here:
- https://currentsapi.services/en/register

## Steps
1. Accept user request at your backend only.
2. Validate and allowlist request params.
3. Call:
   - `https://api.currentsapi.services/v2/latest-news`
   - `https://api.currentsapi.services/v2/search`
4. Authenticate with a bearer Authorization header sourced from the environment.
5. Enforce request quotas + caching.
6. Return normalized response schema and error mapping.

## Date filtering (UTC+0)
- Send `start_date` / `end_date` in RFC3339/ISO-8601 format.
- Convert user-local times to UTC (`Z`) before requesting.
- Treat returned `published` timestamps as UTC (`+0000`).
- Use half-open windows (`>= start`, `< end`) to avoid boundary duplicates.

## Pitfalls
- Exposing owner key in client apps.
- No param validation.
- Missing retries/backoff on 5xx or 429.
- Using default Python urllib User-Agent can trigger Cloudflare/WAF block (`403`, error `1010`).

## Verification
- Key absent from client-side artifacts.
- Bounded page size and validated filters.
- Audit logs redact secret values.
- Backend requests send explicit browser/curl-like `User-Agent`.