A handful of endpoints. No keys.

Ask for a quote with the source asset, destination asset, and amount. Every provider is quoted in parallel; the response lists them all, ordered by reputation score with output as the tie-break. Sort by amountOut yourself if price is what you want — dexr never picks for you. Amounts come back as base-unit strings with the decimals to read them by.

$ curl -X POST https://dexr.pro/api/quote \
     -H "content-type: application/json" \
     -d '{"from":"BTC","to":"ETH","amount":"0.25"}'

{
  "results": [{
    "provider": "thorchain",             // one entry per provider that answered
    "amountOut": "3412000000000000000", // base units — read with toDecimals
    "amountOutUsd": "~$9412.00",
    "etaSec": 660,
    "expiresAt": 1755523199000,          // Unix ms — after this the provider may reprice; re-quote
    "fees": { "protocol": […], "network": […] }
  }, …],
  "failures": [],                       // providers that errored, with reasons
  "skipped": [],                        // providers not asked: disabled, or no support for this pair
  "fromDecimals": 8,
  "toDecimals": 18
}

A quote is a price, not an instruction. POST /api/execute turns it into one: same fields plus provider, destination, and amount as a base-unit integer string, and it answers the network vault address to pay (plus a memo, swap id, or calldata where the provider needs it). You pay the vault directly — the payout goes to your destination, never through us. Chainflip and NEAR also require a refundAddress; for Mayan it's optional.

Status is reconstructed from the chain, not from a database: POST /api/verify with a THORChain deposit txid, or POST /api/track-status with a Chainflip swap id, a NEAR deposit address, or a Mayan tx hash — Symbiosis, which publishes no status API, is followed by watching the payout address on the destination chain. GET /api/receipt?id= (or ?ref= with a deposit tx, deposit address, or provider order id) rebuilds a swap from its 30-day receipt. GET /api/stats exposes the aggregate counters — the server re-verifies state itself across all seven providers, and a server-side watcher keeps every app-initiated swap watched to settlement even after the browser closes, so the only swap that slips through is one that never touches a status endpoint at all; GET /api/providers returns the trust profiles behind the reputation scores.

The same three rules that govern the site govern the API. They are not configurable; they are the point. Exact per-endpoint limits live in the API reference.

• No keys, no accounts — and no IPs, so the limits can't know you either. Each endpoint has one global sliding-window counter, shared by everyone and keyed on nothing. The trade-off, stated plainly: one abuser can briefly exhaust a shared bucket for everyone — over Tor an IP is just a shared exit node, so keying on it would punish strangers and tell us nothing.
• Tor-friendly. Reachable over clearnet for convenience and as an onion service for consistency; responses are identical.
• Nothing about who you are is persisted. Two things are written to disk, both encrypted at rest: an anonymized aggregate counter, and — for 30 days unless you delete it sooner — a per-swap receipt that exists so a swap can be recovered. Status is always reconstructed from the chain, never from a database of your history.