IP addresses in your code: guides for developers

Updated

Short answer

These guides cover the parts of working with IP addresses that go wrong most often in code: reading the real client IP behind proxies and CDNs, looking up location, network and time zone data for it, and doing that with the official SDKs or plain HTTP.

On this page

Most bugs with IP addresses in applications come from two places: the server reads the address of a proxy instead of the visitor, or the code trusts a header that the visitor can set. The guides below fix both, then show how to turn an address into location, network, time zone and security data.

Get the IP address in your code

Look up data for an IP address

The short version

  1. Find the right address. Use the connection’s address unless your own proxy sits in front of the app; then read the proxy’s header and trust it only from that proxy. Details in get the real client IP.
  2. Look it up on the server. Call GET /v1/info?ip=<address> with the key in the apikey header, or use an official SDK. Leave out ip to look up the address of the machine that makes the call.
  3. Ask only for what you use. The fields parameter trims the response, for example fields=ip,location.country.alpha2,timezone.id.
  4. Cache the result. Location and network data for an address change rarely; a cache of a few hours saves requests.
  5. Treat the result as an estimate. Country is usually right; city often is not. Read how accurate IP geolocation is before you block or redirect on it.
Shell
curl "https://api.iplookupapi.com/v1/info?ip=8.8.8.8&fields=ip,location.country.alpha2,timezone.id" \
  -H "apikey: $IPLOOKUPAPI_KEY"

All endpoints, parameters and response fields are in the API documentation.

Frequently asked questions

How do I get a visitor's IP address in my application?

Read it from the connection (REMOTE_ADDR or your framework’s request IP). Behind a proxy, load balancer or CDN that address belongs to the proxy, and the client IP arrives in a header such as CF-Connecting-IP or X-Forwarded-For. Trust that header only when the request came from your own proxy; the real client IP guide shows the setting for each server and framework.

How do I look up the location of an IP address in code?

Send the address to an IP lookup API and read the JSON. With iplookupapi, GET https://api.iplookupapi.com/v1/info?ip=8.8.8.8 with your key in the apikey header returns location, network, time zone and currency data; the SDKs wrap the same call for JavaScript, Python, PHP and more.

Can I look up many IP addresses at once?

Yes. The batch endpoint takes 1 to 1,000 IPv4 or IPv6 addresses in one POST request and returns the same data per address. Each valid address counts as one request. See the batch IP lookup API.

Should I call the IP lookup API from the browser?

No. Your API key would be visible to every visitor. Call the API from your server or an edge function and send the browser only the fields it needs.

Look up IP addresses in your code

iplookupapi returns the location, provider, time zone and security flags of any IP address as JSON. The free plan includes 150 requests a month.

curl "https://api.iplookupapi.com/v1/info?ip=8.8.8.8" \
  -H "apikey: YOUR_API_KEY"