IPLocate API
Free IP geolocation API with no key: country, city, coordinates, ASN, plus VPN, proxy, Tor and hosting detection. 1,000 free lookups a day. Tested example included.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the IPLocate API?
IPLocate is a free IP geolocation API that returns location, network and privacy data for an IP address without an API key. Alongside country, city and coordinates it flags whether the address belongs to a VPN, proxy, Tor exit node, hosting provider or iCloud Private Relay.
Most free IP geolocation APIs stop at country and city. IPLocate goes further with a `privacy` block that is genuinely useful for abuse prevention: separate booleans for VPN, proxy, Tor, hosting, iCloud Private Relay and known abusers. That turns an IP lookup from a display feature into something you can make decisions on.
The `asn` block is the other differentiator. It carries the AS number, network route, registered network name, owning organisation and a `type` field distinguishing hosting from ISP from business networks — enough to tell a residential visitor apart from a datacentre IP without a second data source. Anonymous use is capped at 1,000 lookups a day, which is ample for development and light production.
Quick facts
- Base URL
https://iplocate.io/api- Authentication
- No key needed for up to 1,000 lookups a day. A free account raises the limit; paid plans go further. Every field shown here is available anonymously.
- Rate limit
- 1,000 requests per day per IP without a key.
- Pricing
- Free tier with no signup. Paid plans lift the daily cap and add bulk lookups.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the IPLocate API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Look up 8.8.8.8 with network and privacy data
GET https://iplocate.io/api/lookup/8.8.8.8
curl 'https://iplocate.io/api/lookup/8.8.8.8'const res = await fetch("https://iplocate.io/api/lookup/8.8.8.8");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://iplocate.io/api/lookup/8.8.8.8", timeout=20)
res.raise_for_status()
print(res.json()){
"ip": "8.8.8.8",
"country": "United States",
"country_code": "US",
"is_eu": false,
"city": "Mountain View",
"continent": "North America",
"latitude": 37.38605,
"longitude": -122.08385,
"time_zone": "America/Los_Angeles",
"postal_code": "94035",
"subdivision": "California",
"currency_code": "USD",
"calling_code": "1",
"is_anycast": true,
"is_satellite": false,
"asn": {
"asn": "AS15169",
"route": "8.8.8.0/24",
"netname": "GOOGLE",
"name": "Google LLC",
"country_code": "US",
"domain": "google.com",
"type": "hosting",
"rir": "ARIN"
},
"privacy": {
"is_abuser": false,
"is_anonymous": false,
"is_bogon": false,
"is_hosting": true,
"is_icloud_relay": false,
"is_proxy": false,
"is_tor": false,
"is_vpn": false
},
"hosting": {
"provider": "Google Cloud",
"domain": "cloud.google.com",
"network": "8.8.8.0/24"
},
"company": {
"name": "Google LLC",
"domain": "google.com",
"country_code": "US",
"type": "hosting"
},
"abuse": {
"address": "1600 Amphitheatre Parkway, Mountain View, CA, 94043, US",
"country_code": "US",
"email": "network-abuse@google.com",
"name": "Google LLC",
"network": "8.8.8.0 - 8.8.8.255",
"phone": "+1-650-253-0000"
}
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
ip | path segment | Optional | The IPv4 or IPv6 address to look up. Omit it entirely to geolocate the caller's own IP. 8.8.8.8 |
apikey | query | Optional | Optional API key. Only needed once you exceed the anonymous daily limit. |
Response fields
country / country_codestring- Country name and ISO 3166-1 alpha-2 code.
city / subdivision / postal_codestring- City, state or region, and postal code. These are empty for some addresses — anycast and carrier-grade NAT ranges often resolve no finer than country.
latitude / longitudefloat- Approximate coordinates. These indicate a network's registered area, not a user's position, and are frequently a city or country centroid.
is_euboolean- Whether the country is an EU member state — convenient for GDPR-driven consent logic.
asnobject- Network details: `asn`, `route`, `netname`, `name`, `domain`, `rir` and `type` (hosting, isp, business, education).
privacyobject- Booleans for `is_vpn`, `is_proxy`, `is_tor`, `is_hosting`, `is_icloud_relay`, `is_abuser`, `is_bogon` and `is_anonymous`.
is_anycastboolean- True for anycast addresses such as public DNS resolvers, where a single IP is announced from many locations at once and city-level data is meaningless.
currency_code / calling_code / time_zonestring- Country currency, international dialling code and IANA timezone.
What you can build with the IPLocate API
- Block or challenge signups coming from VPNs, Tor exits or datacentre ranges
- Preselect country, currency and language for a new visitor
- Show an EU cookie consent banner only when `is_eu` is true
- Enrich server logs or analytics with ASN and network type
Common errors and how to fix them
400
The path segment is not a valid IP address.
Fix: Validate the input before calling. Private and reserved ranges return a result with `is_bogon` set rather than an error.
429
Daily anonymous limit of 1,000 lookups exceeded.
Fix: Cache results per IP — geolocation data changes on the order of weeks — or register a free key.
IPLocate API — frequently asked questions
Is the IPLocate API free without an API key?
Yes. Up to 1,000 lookups a day work with no key and no signup, and the full response including the ASN and privacy blocks is returned anonymously. A free account raises the daily cap.
Can IPLocate detect VPNs and proxies?
Yes — that is its main advantage over simpler free geolocation APIs. The `privacy` object returns separate booleans for VPN, proxy, Tor, hosting, iCloud Private Relay and known abusive addresses, so you can apply different rules to each.
How accurate is the city-level data?
Country-level accuracy is high; city-level is approximate and depends entirely on how the network is registered. Anycast addresses (flagged by `is_anycast`) and mobile carrier ranges often return no city at all, or a country centroid — never treat the coordinates as a user's real position.
Can I call IPLocate from the browser?
Yes, it sends CORS headers. Calling it with no path segment returns data for the visitor's own IP, which is the usual pattern for client-side use.
Tools that pair with this API
IP Address Validator
Validate lists of IPv4, IPv6 and CIDR entries with the exact failure reason per line — compressed ::, IPv4-mapped forms and prefixes included. Free.
Private IP Address Checker
Check if an IPv4 or IPv6 address is private, loopback, link-local, CGNAT or otherwise special — with the matching RFC and public-routability verdict.
IP to Binary Converter
Convert IPv4 and IPv6 addresses to binary with a per-octet bit table, and turn 32-bit binary back into an IP. Free, instant and fully in your browser.
IPLocate is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.