Fetch the NBC rate from your own system

One HTTP endpoint returns the official National Bank of Cambodia USD to KHR rate for any date RielSync holds. It is for developers and IT implementers who would rather pull the rate into a till, an ERP or a script than have RielSync write it in for them.

Quick start

1. Create a key in the console under Settings, API keys. Copy it when it is shown.
2. Send it as a Bearer token on a GET request.
3. Read rate from the JSON response.

curl https://www.rielsync.com/public/v1/rates \
  -H "Authorization: Bearer rs_live_7f2c9a41e8b3d05c"

{
  "date": "2026-09-17",
  "rate": 4040,
  "base": "USD",
  "quote": "KHR",
  "rate_date": "2026-09-17",
  "carried_forward": false
}

Authentication

Every request carries a key created in the console. Keys look like rs_live_... and belong to the account, not to a single connection. An account can hold up to five at once, which is what makes rotation safe: create a new key, point your system at it, then delete the old one.

Authorization: Bearer rs_live_7f2c9a41e8b3d05c

A missing or unrecognised key returns 401 invalid_key. A valid key on an account without the API returns 403 not_enabled.

Calling from a browser

A page on your own website can call the API directly, because the API accepts cross-origin requests from any origin. Only GET requests are allowed, and the key goes in the Authorization header. Your script can read X-RateLimit-Limit, X-RateLimit-Remaining and Retry-After from the response. Anything on a public page can be read by anyone who views it, including your key. Where you can, call the API from your own server and pass the rate on to the page.

Three ways to call it

Response fields

Errors

Limits and good behaviour

Each key is limited to 10 requests a second, 3,000 an hour and 20,000 a day. The hourly limit resets on the hour. The daily limit resets at midnight Cambodian time. The per-second limit is approximate. Going over a limit returns 429 rate_limited with a Retry-After header giving the number of seconds to wait. Successful responses include X-RateLimit-Limit and X-RateLimit-Remaining for the hourly limit.

Requests with a missing or invalid key are counted for each address. After 20 of them within 10 minutes, that address is blocked for 15 minutes and requests from it receive a 429 with a Retry-After header. Requests with a valid key are not counted.

The API can be used with SambaPOS by anyone comfortable wiring up an HTTP call, and the RielSync team is available to help. There is no ready-made plugin. POSFlow Solutions, our own point of sale company, has this built in, so POSFlow Solutions customers do not need to write any code.

In other languages

const res = await fetch(
  "https://www.rielsync.com/public/v1/rates",
  { headers: { Authorization: `Bearer ${key}` } }
);
const { rate, rate_date } = await res.json();

r = requests.get(
    "https://www.rielsync.com/public/v1/rates",
    headers={"Authorization": f"Bearer {key}"},
)
rate = r.json()["rate"]

These are plain HTTP requests written out. RielSync does not ship a client library.