You Are Using the API Without a Key

If you arrived here from the docs field of an API response, that response reached api.ipapi.is without an API key. Nothing is wrong — you are being served, just on the anonymous tier, which returns a smaller answer than the one documented on the developer documentation.

This page exists because the response alone cannot tell you which of two things happened. A field you expected can be absent because we genuinely have no data for that address, or because the request carried no key. Those call for opposite reactions, and only the second one is something you can fix, so the API points at this page rather than letting you guess.

What the anonymous tier returns

Eleven keys: who the address belongs to, where it is, and the docs link that brought you here. Every key is always present and is null when we have no value for it, so you can read the shape without defensive checks.

{
  "ip": "82.66.115.249",
  "is_bogon": false,
  "company": "Proxad / Free SAS",
  "asn": "AS12322 Free SAS",
  "city": "Goven",
  "region": "Brittany",
  "country": "France",
  "lat": 48.0063,
  "lon": -1.84667,
  "timezone": "Europe/Paris",
  "docs": "https://ipapi.is/free-tier.html"
}

These values are not approximations of the paid ones. Each is copied out of the same record the full response is built from, so where a field appears in both it is identical in both. The anonymous tier gives you less data, never different data.

What changed on 1 September 2026

If your code was reading this response before that date and has started returning undefined, this is why. Some fields were renamed, the geolocation fields were expanded, and the detection flags moved behind a key. Responses made with an API key were not affected at all.

The detection flags are the part of this dataset that costs the most to produce and keep current: enumerating VPN exit nodes provider by provider, crawling reverse DNS for the entire IPv4 address space, tracking hosting ranges, and capturing abusive traffic. Giving those verdicts away dozens of times a day to anyone who asks is not a free tier, it is the product. Ownership and geolocation are not in that category, so they stay free — and got better in the same change, since you now get the city, region and timezone that were never in the anonymous response before.

If you were using those flags, a free account gives them back immediately along with everything below, at a higher daily limit and with no payment details.

What a key adds

The full response is roughly five times the size and answers questions the short one does not touch. In particular:

• The detection flags — is_datacenter, is_vpn, is_proxy, is_tor and is_abuser, with the reasoning behind each: which datacenter, which VPN provider, which blocklist, the numeric abuser score and the reverse DNS record. This is the part of the dataset that takes continuous VPN exit-node enumeration, a reverse-DNS crawl of the entire IPv4 space and an abuse capture to keep current, and it is what a key pays for.
• Location detail — postal code, local time, UTC offset, calling code, currency and an accuracy radius on top of the city and region you already get.
• The company and ASN objects — network range, registry, domain, organisation type (hosting, ISP, education, government, banking, business), the date the block was allocated and the ASN's own registry metadata.
• Abuse contact — the address, name and phone number to report a problem to, which is the field most people are actually looking for.
• Bulk lookups and ASN queries, which the anonymous tier refuses outright with 403 ERR_FORBIDDEN_API_KEY_REQUIRED. Both are wholesale requests, and a key is what makes them accountable to someone.

The live demo on the home page and the field-by-field reference in the documentation both show the complete response.

Limits without a key

Anonymous use is capped at 30 lookups per client IP per UTC day. Past that the API answers 429 for the next 10 requests, telling you the budget is gone and where to get a free key. A client that ignores those notices and keeps sending is blocked at the firewall for 24 hours, so it is worth handling the 429 rather than retrying through it.

The budget is per address, which matters if you are behind a shared or carrier-grade NAT: you may reach the limit sooner than your own traffic explains. A key meters your account instead of your address and removes that problem.

Getting a key

A free account raises you to 1,000 lookups a day and returns the complete response. It takes a minute and needs no payment details — sign up, then find your key in the dashboard. Higher volumes are on the pricing page, and if you would rather not call an API at all, the same data ships as downloadable CSV and MMDB databases.

Pass the key in the query string:

curl "https://api.ipapi.is/?q=82.66.115.249&key=your_api_key"

Or in the JSON body of a POST, which keeps it out of logs and browser history:

curl --header "Content-Type: application/json" \
  --request POST \
  --data '{"q": "82.66.115.249", "key": "your_api_key"}' \
  https://api.ipapi.is

Keep the key on your own infrastructure. Anything shipped to a browser is public, and a key in a public repository or a page's JavaScript will be found and spent by someone else.

If you meant to stay anonymous

That is a supported way to use the API and always has been. The anonymous tier is not a trial that expires, and the docs field is a signpost rather than a warning. If the ten fields answer your question, you need nothing from this page — ignore the key and carry on.

Questions, or a field that looks wrong? The contact page reaches us, and data corrections go through the corrections form.