All integrations

ipdata

DATA · DATA & ANALYTICS

IP geolocation, ASN, carrier, and threat lookups on their own key.

Connecting ipdata in practice

ipdata takes its key as an api-key query parameter and expects to be called straight from the browser, so its main access control is a domain whitelist evaluated from the referer header — and anything that strips that header turns the protection off without producing an error. A separate EU endpoint at eu-api.ipdata.co exists so end-user IP addresses never leave the EU.

Scopes that draw scrutiny

  • api-key (query parameter) Visible in view-source on any client-side call. ipdata’s documented mitigation is referer-based domain whitelisting rather than a second, restricted key type.

Worth knowing

  • Once whitelisting is enabled, requests from a host that is not on the list get a 403, so every new deploy domain or preview URL breaks lookups until it is added.
  • A <meta name="referrer" content="no-referrer"> tag or a proxy that strips the referer header silently disables whitelisting, which is a security failure that looks like nothing at all.
  • Client-side calls omit the IP and let ipdata read it from the TCP connection, while server-side calls must pass it explicitly — and which header holds the real client IP varies by platform (REMOTE_ADDR, HTTP_CF_CONNECTING_IP and so on).
  • EU data residency is a different hostname rather than a parameter, so it is a deploy-time decision baked into the client.

Checked against Quick start (2026-09-29), Client-side vs server-side (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

ipdata_get_by_asnWRITE

Retrieve the Autonomous System record for an AS number, e.g. AS15169: the organisation's name and domain, the usage type (hosting, isp, edu, business, gov, military or unknown) and the IPv4 and IPv6 prefixes it announces. Pass the number WITH its AS prefix. An unknown AS number is answered 404 'ASBlah was not found.'. The fields filter does not apply to this endpoint -- ipdata returns the whole ASN record regardless (measured). ASN data is not included on every plan; a plan that does not carry it is answered 403.

api
ipdata_get_by_ipWRITE

Geolocate a single IPv4 or IPv6 address and return what ipdata knows about it: city, region, country, continent, latitude and longitude, postal code, calling code and flag; the time zone, currency and languages of that location; the Autonomous System and company behind the address; the mobile carrier where there is one; and the threat intelligence block (Tor, proxy, VPN, known attacker or abuser, blocklists). Narrow the answer with `fields`, a comma-separated list of top-level field names. A private or reserved address is refused by ipdata with a 400 naming it, and so is anything that is not an address. Which fields are populated depends on the account's plan rather than on this request.

api
ipdata_post_bulkWRITE

Geolocate up to 100 IP addresses in one call and get back an array of the same records the single lookup returns, in the order sent. PAID PLANS ONLY: a free account is answered 403 'Upgrade to a paid plan to make bulk requests.'. EACH ADDRESS COUNTS AS A REQUEST against the account's quota, so one full call spends 100 of them. More than 100 addresses is refused with 400; so is a body that is not a JSON array.

api

Put ipdata behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.