DEV Community: Vix

Why IP geolocation fails — and what to do about it

Vix — Fri, 03 Jul 2026 12:13:42 +0000

Why IP geolocation fails — and what to do about it

IP geolocation is one of those technologies that works well enough that people use it everywhere, and badly enough that it regularly causes real problems. If you've ever been locked out of a service because you were "in the wrong country," or seen a website serve you the wrong currency, or had a VPN break an app — you've experienced the failure modes firsthand.

This article explains why geolocation fails, when it fails most, and how to build software that handles those failures gracefully.

What IP geolocation actually does

Every IP address is assigned to an organization — an ISP, a company, a university, a cloud provider. That assignment is public record, documented in databases maintained by regional internet registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC). Geolocation databases map those organizational assignments to physical locations using a combination of:

Registry data (where the organization is headquartered)
BGP routing data (where traffic for that IP originates)
Active probing and latency measurements
Commercial data purchases from ISPs

The result is an educated guess, not a lookup. The databases are updated periodically — MaxMind, for example, updates GeoLite2 twice per week — but IP assignments change faster than updates can track, and the underlying mapping is inherently approximate.

The five most common failure modes

1. VPNs and proxies

When a user connects through a VPN, the IP address you see is the VPN exit node — which might be in a completely different country from the user. This is by design from the user's perspective, but it means your geolocation data is wrong for that session.

VPN usage has grown substantially. Estimates vary, but surveys consistently show 25-30% of internet users use a VPN at least monthly. In some regions — particularly in countries with content restrictions — it's the majority of users.

What to do: if accurate location matters for your application, don't rely on IP alone. Use geolocation as a default, but let users override it. Never silently use IP geolocation for anything with legal or financial consequences.

2. Mobile carrier NAT

Mobile networks frequently use carrier-grade NAT (CGNAT), where thousands of users share a single public IP address. That shared IP may be located at a carrier data center in a different city or region from the actual users behind it.

A user in a rural area connecting through a mobile carrier might have their traffic exit at a major city hub, making them appear to be in that city.

What to do: for mobile users, IP geolocation accuracy drops significantly at the city level. Treat city-level data from mobile IPs as approximate at best.

3. Corporate networks and offices

Companies often route all employee internet traffic through a central gateway, sometimes in a different country from where the employee is actually working. Remote workers, in particular, frequently appear to be in the location of their company's headquarters or VPN server.

What to do: be especially cautious about IP geolocation for B2B applications where users are likely to be on corporate networks.

4. Cloud and datacenter IPs

Traffic originating from cloud providers (AWS, Google Cloud, Azure, Oracle) doesn't represent a user's location — it represents a data center location. If your application is being accessed by another application running in the cloud, the geolocation will reflect where that server is, not where the actual user or operator is.

import requests

def get_ip_info():
    r = requests.get('https://ippubblico.org/?api=1')
    data = r.json()
    return {
        'ip':  data['ip'],
        'isp': data['isp'],
        'asn': data['asn'],
    }

# Check if traffic is from a cloud provider
CLOUD_ASNS = {
    'AS16509',  # Amazon AWS
    'AS15169',  # Google Cloud
    'AS8075',   # Microsoft Azure
    'AS396982', # Google Cloud (secondary)
    'AS14061',  # DigitalOcean
    'AS20473',  # Vultr
}

info = get_ip_info()
is_cloud = info['asn'] in CLOUD_ASNS

What to do: check the ASN of incoming connections. If it belongs to a known cloud provider, treat the geolocation as unreliable and either skip geolocation-based logic or flag the request for additional verification.

5. Stale database entries

IP blocks get reassigned. A block that belonged to an ISP in Germany might be sold and reassigned to a company in Brazil. Database providers update their data, but there's always a lag — and during that lag, every request from those IPs returns wrong data.

This is particularly common with IPv6, where the geolocation databases are less complete and less frequently updated than IPv4.

What to do: for IPv6 addresses, treat geolocation data as less reliable than for IPv4. Design your application to degrade gracefully when geolocation data is missing or uncertain.

How to check what geolocation actually returns

Before building on top of geolocation data, test what your users actually see. IPPubblico.org returns the full geolocation data for the requesting IP with no setup:

curl "https://ippubblico.org/?api=1"

{
  "status": "ok",
  "ip": "203.0.113.42",
  "isp": "NTT Communications",
  "asn": "AS2914",
  "geo": {
    "city": "Tokyo",
    "region": "Tokyo",
    "country": "Japan",
    "country_code": "JP",
    "lat": 35.6893,
    "lon": 139.6899
  }
}

The asn and isp fields are particularly useful for detecting the failure modes above — a VPN, cloud provider, or CGNAT carrier shows up clearly in those fields even when the country/city data looks plausible.

Accuracy by use case

Use case	Accuracy	Notes
Country detection	~95%	Good for most users, breaks for VPN/corporate
Region/state	~75%	Acceptable for content personalization
City	~50-60%	Rough approximation, unreliable for mobile
Coordinates	Variable	Treat as center of city/region, not actual location
Street address	Not possible	Never attempt this with IP geolocation

These numbers are rough industry estimates — real accuracy depends heavily on your user base. A B2C consumer app will see higher accuracy than a B2B tool used by people on corporate networks.

Building geolocation-aware code that handles failures

Always provide a fallback

async function getUserCountry() {
  try {
    const res  = await fetch('https://ippubblico.org/?api=1', {
      signal: AbortSignal.timeout(3000)
    });
    const data = await res.json();
    return data.geo?.country_code ?? 'US'; // fallback to US
  } catch {
    return 'US'; // fallback on network error
  }
}

Let users override

function getEffectiveCountry(detectedCountry) {
  // Check if user has manually set their country
  const userOverride = localStorage.getItem('user_country');
  return userOverride ?? detectedCountry;
}

Use geolocation for defaults, not enforcement

// Good: use geolocation to pre-select a currency, but let users change it
const detectedCountry = await getUserCountry();
const defaultCurrency = CURRENCY_MAP[detectedCountry] ?? 'USD';

// Bad: block users based on geolocation alone
if (detectedCountry === 'XX') {
  throw new Error('Service not available in your country'); // Don't do this
}

Check ASN for cloud/VPN detection

import requests

def get_connection_type(ip=None):
    url = 'https://ippubblico.org/?api=1'
    if ip:
        url += f'&ip={ip}'

    data = requests.get(url, timeout=5).json()
    asn = data.get('asn', '')
    isp = data.get('isp', '').lower()

    # Known cloud/VPN indicators
    cloud_keywords = ['amazon', 'google', 'microsoft', 'digitalocean',
                      'vultr', 'linode', 'ovh', 'hetzner']
    vpn_keywords   = ['vpn', 'proxy', 'tunnel', 'nordvpn', 'expressvpn']

    is_cloud = any(kw in isp for kw in cloud_keywords)
    is_vpn   = any(kw in isp for kw in vpn_keywords)

    return {
        'country':   data['geo']['country_code'],
        'is_cloud':  is_cloud,
        'is_vpn':    is_vpn,
        'reliable':  not is_cloud and not is_vpn,
    }

What geolocation is good for

Despite the failure modes, IP geolocation is genuinely useful when used appropriately:

Default language/locale selection — reasonable default, easy to override
Content delivery optimization — CDN routing, selecting the nearest server
Fraud detection signals — one signal among many, not a definitive check
Analytics and traffic analysis — aggregate country-level data is reliable even if individual lookups sometimes aren't
Regulatory compliance logging — logging the detected country for audit purposes, while accepting that it may be wrong

What geolocation should never be used for alone

Access control or blocking — VPNs and CGNAT mean the "wrong" people will always get through, and the "right" people will sometimes get blocked
Legal jurisdiction determination — use user-provided and verified information instead
Payment fraud prevention — a signal, not a decision
Anything with permanent consequences — detected location can change on the next request

Conclusion

IP geolocation is a useful heuristic, not a reliable fact. The failure modes — VPNs, CGNAT, corporate gateways, cloud IPs, stale data — are common enough that any production system should be designed with them in mind from the start.

The practical rule: use geolocation for defaults and personalization, never for enforcement. Let users override it. Check ASN data to flag likely-unreliable cases. And test what your actual users see before making architectural decisions based on geolocation accuracy assumptions.

Have you run into a particularly bad geolocation failure in production? The comments are a good place to share war stories.

ipinfo.io vs IPPubblico.org — which free IP API should you use in 2026?

Vix — Tue, 30 Jun 2026 09:06:36 +0000

ipinfo.io vs IPPubblico.org — which free IP API should you use in 2026?

ipinfo.io is one of the most established IP geolocation services, with good data quality and a generous free tier. If you're evaluating it for a project, this article gives you a practical, technical comparison against IPPubblico.org — covering what each does well, where they differ, and which fits which use case.

The basics

	ipinfo.io	IPPubblico.org
API key required	Yes (free tier)	No
Free tier limit	50,000 req/month	No hard limit, fair use
HTTPS	Yes	Yes
Plain text endpoint	No	Yes
JSON endpoint	Yes	Yes
Multilingual response	No	Yes (43 languages, 7 fully localized)
Pricing beyond free tier	Paid plans from $99/mo	Free

API key — the core difference

ipinfo.io requires a token even on the free tier:

curl "https://ipinfo.io/8.8.8.8/json?token=YOUR_TOKEN"

{
  "ip": "8.8.8.8",
  "city": "Mountain View",
  "region": "California",
  "country": "US",
  "loc": "37.4056,-122.0775",
  "org": "AS15169 Google LLC",
  "timezone": "America/Los_Angeles"
}

This is fine for most backend applications — you register once, store the token in an environment variable, done. But it's a real constraint for:

Embedded devices and firmware — a key baked into deployed hardware can't be rotated easily, and if ipinfo.io invalidates it, every device in the field breaks
Quick scripts and prototypes — registering for a key adds friction when you just want to test something
Open source projects — shipping a default token in a public repo is a bad practice; asking every user to get their own key adds setup steps

IPPubblico has no key at all:

curl "https://ippubblico.org/?api=1"

{
  "status": "ok",
  "ip": "8.8.8.8",
  "isp": "Google LLC",
  "asn": "AS15169",
  "timezone": "America/Los_Angeles",
  "geo": {
    "city": "Mountain View",
    "region": "California",
    "country": "United States",
    "country_code": "US",
    "lat": 37.4056,
    "lon": -122.0775
  }
}

Same data, same depth, zero setup.

Rate limits

ipinfo.io's free tier: 50,000 requests/month, which works out to roughly 1,660/day or about one request every 52 seconds on average if spread evenly. In practice traffic isn't evenly spread, so bursts can hit the limit faster than the daily average suggests.

IPPubblico: no monthly cap, with a soft rate limit per IP (currently 10 seconds between requests) to keep the service stable. For a single application or device, this is effectively unlimited for normal use — DDNS updates, geolocation lookups, periodic checks all sit comfortably under that threshold.

If you're building something with unpredictable or bursty traffic and don't want to think about monthly quotas, this matters.

Data quality and depth

ipinfo.io is well known for accurate data, particularly around ASN and organization details, and offers additional paid datasets (privacy detection, carrier data, abuse contacts) that IPPubblico doesn't provide.

IPPubblico's data comes from MaxMind GeoLite2 — the same open dataset used by a large share of the free IP geolocation ecosystem. For city/country/ISP-level data, the two are comparable in accuracy for most use cases. If you specifically need VPN/proxy detection or carrier-level mobile data, ipinfo.io's paid tiers cover that; IPPubblico doesn't.

Multilingual responses — IPPubblico's distinct feature

This is the one capability the comparison isn't close on. IPPubblico returns city, region, and country names in the requester's language:

curl "https://ippubblico.org/?api=1&lang=ja"

{
  "geo": {
    "city": "東京",
    "region": "東京都",
    "country": "日本"
  }
}

Localized data is available for German, Spanish, French, Japanese, Portuguese, Russian, and Chinese — all interface languages (43 total) work for the website, but geo-field localization is currently limited to those seven. ipinfo.io always returns English regardless of any language parameter, because it doesn't have one.

For applications with non-English-speaking users where you want to display "Tokyo, Japan" as "東京、日本" without maintaining your own translation table, this removes a real chunk of work.

Plain text endpoint

ipinfo.io's API is JSON-first; getting just the IP without parsing requires hitting ipinfo.io/ip:

curl "https://ipinfo.io/ip?token=YOUR_TOKEN"
# 203.0.113.42

This works but still requires a token. IPPubblico has dedicated subdomains for this exact case, no key needed:

curl https://ipv4.ippubblico.org/
# 203.0.113.42

curl https://ipv6.ippubblico.org/
# 2001:db8::1  (or NONE if unavailable)

For embedded firmware parsing a one-line response with minimal memory, this is a meaningfully simpler integration — no JSON parser needed at all.

Code comparison — Python

ipinfo.io:

import requests

TOKEN = 'your_token_here'

def get_ip_info():
    r = requests.get(f'https://ipinfo.io/json?token={TOKEN}')
    return r.json()

info = get_ip_info()
print(info['city'], info['country'])

IPPubblico:

import requests

def get_ip_info():
    r = requests.get('https://ippubblico.org/?api=1')
    return r.json()

info = get_ip_info()
print(info['geo']['city'], info['geo']['country'])

Nearly identical, minus the token management.

When ipinfo.io is the better choice

You need VPN/proxy/abuse detection — IPPubblico doesn't offer this
You need carrier-level mobile network data
You're already paying for a higher tier and need SLA guarantees
Your traffic genuinely exceeds what a free, key-less service should reasonably handle, and you want a commercial relationship with uptime commitments

When IPPubblico is the better choice

You're building IoT/embedded firmware where API key management is impractical
You want zero setup for a prototype or internal tool
You need localized geo names for a non-English-speaking user base
You don't want to track or worry about a monthly request quota
You want a plain text endpoint with no parsing overhead

Quick reference

Need	Best choice
VPN/proxy detection	ipinfo.io
No API key, zero setup	IPPubblico.org
Embedded/IoT firmware	IPPubblico.org
Localized language responses	IPPubblico.org
Carrier/mobile network data	ipinfo.io
Plain text IP only	IPPubblico.org
Enterprise SLA	ipinfo.io

Full IPPubblico documentation: ippubblico.org/docs.html
Code examples (ESP32, Raspberry Pi, OpenWRT, Python, Node.js, Go): github.com/ippubblico/examples

Which one are you using in production? Curious to hear real-world experiences with either.

Getting the public IP in Go — no dependencies, no API key

Vix — Mon, 29 Jun 2026 03:05:03 +0000

Getting the public IP in Go — no dependencies, no API key

Go's standard library is famously self-contained, and IP detection is a case where that pays off directly. Everything in this article uses only the standard library plus one optional third-party HTTP client — no SDK, no configuration file, no API key required. The API is IPPubblico.org: free, HTTPS, plain text and JSON endpoints, no authentication.

Use case 1 — Your server's own public IP (one-liner)

The simplest case: a Go program or script that needs to know its own public IP.

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
    "time"
)

func getPublicIP() (string, error) {
    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Get("https://ipv4.ippubblico.org/")
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        return "", err
    }
    return strings.TrimSpace(string(body)), nil
}

func main() {
    ip, err := getPublicIP()
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    fmt.Printf("Public IP: %s\n", ip) // Public IP: 203.0.113.42
}

No imports beyond the standard library. The Timeout on the HTTP client prevents the program from hanging indefinitely if the network is unavailable.

Use case 2 — Full geolocation data

When you need country, city, ISP and ASN in addition to the IP address:

package main

import (
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "time"
)

type GeoData struct {
    Country     string  `json:"country"`
    CountryCode string  `json:"country_code"`
    City        string  `json:"city"`
    Region      string  `json:"region"`
    Lat         float64 `json:"lat"`
    Lon         float64 `json:"lon"`
}

type IPInfo struct {
    Status   string  `json:"status"`
    IP       string  `json:"ip"`
    IPv4     string  `json:"ipv4"`
    IPv6     *string `json:"ipv6"`
    ISP      string  `json:"isp"`
    ASN      string  `json:"asn"`
    Timezone string  `json:"timezone"`
    Geo      GeoData `json:"geo"`
}

func getIPInfo() (*IPInfo, error) {
    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Get("https://ippubblico.org/?api=1")
    if err != nil {
        return nil, err
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        return nil, err
    }

    var info IPInfo
    if err := json.Unmarshal(body, &info); err != nil {
        return nil, err
    }
    if info.Status != "ok" {
        return nil, fmt.Errorf("API returned status: %s", info.Status)
    }
    return &info, nil
}

func main() {
    info, err := getIPInfo()
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    fmt.Printf("IP:       %s\n", info.IP)
    fmt.Printf("Country:  %s (%s)\n", info.Geo.Country, info.Geo.CountryCode)
    fmt.Printf("City:     %s, %s\n", info.Geo.City, info.Geo.Region)
    fmt.Printf("ISP:      %s\n", info.ISP)
    fmt.Printf("Timezone: %s\n", info.Timezone)
}

Use case 3 — Reusable client with caching

In a real application you rarely want to call the API on every request. This client caches the result for a configurable duration:

package ipdetect

import (
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "sync"
    "time"
)

type Client struct {
    httpClient *http.Client
    cacheTTL   time.Duration

    mu        sync.Mutex
    cached    *IPInfo
    cachedAt  time.Time
}

type IPInfo struct {
    IP      string `json:"ip"`
    Country string `json:"country"`
    City    string `json:"city"`
    ISP     string `json:"isp"`
    ASN     string `json:"asn"`
}

func NewClient(cacheTTL time.Duration) *Client {
    return &Client{
        httpClient: &http.Client{Timeout: 10 * time.Second},
        cacheTTL:   cacheTTL,
    }
}

func (c *Client) Get() (*IPInfo, error) {
    c.mu.Lock()
    defer c.mu.Unlock()

    if c.cached != nil && time.Since(c.cachedAt) < c.cacheTTL {
        return c.cached, nil
    }

    resp, err := c.httpClient.Get("https://ippubblico.org/?api=1")
    if err != nil {
        return nil, fmt.Errorf("request failed: %w", err)
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        return nil, fmt.Errorf("read body: %w", err)
    }

    var raw struct {
        Status string  `json:"status"`
        IP     string  `json:"ip"`
        ISP    string  `json:"isp"`
        ASN    string  `json:"asn"`
        Geo    struct {
            Country string `json:"country"`
            City    string `json:"city"`
        } `json:"geo"`
    }
    if err := json.Unmarshal(body, &raw); err != nil {
        return nil, fmt.Errorf("parse JSON: %w", err)
    }

    info := &IPInfo{
        IP:      raw.IP,
        ISP:     raw.ISP,
        ASN:     raw.ASN,
        Country: raw.Geo.Country,
        City:    raw.Geo.City,
    }
    c.cached = info
    c.cachedAt = time.Now()
    return info, nil
}

Usage:

client := ipdetect.NewClient(1 * time.Hour)

info, err := client.Get() // calls API
info, err  = client.Get() // returns cached result

Use case 4 — DDNS updater

A production-ready DDNS updater that detects IP changes and updates a Cloudflare DNS record:

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"
    "strings"
    "time"
)

const (
    cfAPIToken  = "your_cloudflare_api_token"
    cfZoneID    = "your_zone_id"
    cfRecordID  = "your_record_id"
    recordName  = "home.yourdomain.com"
    cacheFile   = "/tmp/ddns_last_ip.txt"
    checkEvery  = 5 * time.Minute
)

var httpClient = &http.Client{Timeout: 10 * time.Second}

func getPublicIP() (string, error) {
    resp, err := httpClient.Get("https://ipv4.ippubblico.org/")
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    return strings.TrimSpace(string(body)), nil
}

func getLastKnownIP() string {
    data, err := os.ReadFile(cacheFile)
    if err != nil {
        return ""
    }
    return strings.TrimSpace(string(data))
}

func saveIP(ip string) {
    os.WriteFile(cacheFile, []byte(ip), 0644)
}

func updateCloudflare(ip string) error {
    url := fmt.Sprintf(
        "https://api.cloudflare.com/client/v4/zones/%s/dns_records/%s",
        cfZoneID, cfRecordID,
    )
    payload := map[string]interface{}{
        "type":    "A",
        "name":    recordName,
        "content": ip,
        "ttl":     60,
    }
    body, _ := json.Marshal(payload)

    req, _ := http.NewRequest("PUT", url, bytes.NewReader(body))
    req.Header.Set("Authorization", "Bearer "+cfAPIToken)
    req.Header.Set("Content-Type", "application/json")

    resp, err := httpClient.Do(req)
    if err != nil {
        return err
    }
    defer resp.Body.Close()

    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    if result["success"] != true {
        return fmt.Errorf("cloudflare error: %v", result["errors"])
    }
    return nil
}

func checkAndUpdate() {
    current, err := getPublicIP()
    if err != nil {
        log.Printf("Failed to get IP: %v", err)
        return
    }

    last := getLastKnownIP()
    if current == last {
        log.Printf("IP unchanged: %s", current)
        return
    }

    log.Printf("IP changed: %s → %s", last, current)
    if err := updateCloudflare(current); err != nil {
        log.Printf("DNS update failed: %v", err)
        return
    }
    saveIP(current)
    log.Printf("DNS updated to %s", current)
}

func main() {
    log.Println("DDNS updater started")
    checkAndUpdate()
    for range time.Tick(checkEvery) {
        checkAndUpdate()
    }
}

Build as a single static binary — no runtime dependencies:

go build -o ddns_updater .
# or cross-compile for Linux ARM (e.g. Raspberry Pi)
GOOS=linux GOARCH=arm64 go build -o ddns_updater_arm64 .

Use case 5 — HTTP middleware for Gin

Detect the client's country and attach it to the Gin context for use in any handler:

package middleware

import (
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "strings"
    "sync"
    "time"

    "github.com/gin-gonic/gin"
)

var (
    geoCache   = make(map[string]string)
    geoCacheMu sync.RWMutex
    httpClient = &http.Client{Timeout: 3 * time.Second}
)

func getCountry(ip string) string {
    geoCacheMu.RLock()
    if c, ok := geoCache[ip]; ok {
        geoCacheMu.RUnlock()
        return c
    }
    geoCacheMu.RUnlock()

    resp, err := httpClient.Get("https://ippubblico.org/?api=1")
    if err != nil {
        return ""
    }
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)

    var data struct {
        Geo struct {
            CountryCode string `json:"country_code"`
        } `json:"geo"`
    }
    json.Unmarshal(body, &data)

    geoCacheMu.Lock()
    geoCache[ip] = data.Geo.CountryCode
    geoCacheMu.Unlock()

    return data.Geo.CountryCode
}

func GeoMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        ip := c.ClientIP()
        country := getCountry(ip)
        c.Set("country_code", country)
        c.Next()
    }
}

Usage in any Gin handler:

r := gin.Default()
r.Use(middleware.GeoMiddleware())

r.GET("/content", func(c *gin.Context) {
    country, _ := c.Get("country_code")
    c.JSON(200, gin.H{
        "country": country,
        "content": "Hello from " + fmt.Sprint(country),
    })
})

Use case 6 — IPv4 and IPv6 detection

package main

import (
    "bufio"
    "fmt"
    "net/http"
    "strings"
    "time"
)

type DualStackIP struct {
    IPv4 string
    IPv6 string
}

func getBothIPs() (*DualStackIP, error) {
    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Get("https://ippubblico.org/?text=1")
    if err != nil {
        return nil, err
    }
    defer resp.Body.Close()

    result := &DualStackIP{}
    scanner := bufio.NewScanner(resp.Body)
    for scanner.Scan() {
        line := scanner.Text()
        if strings.HasPrefix(line, "IPv4: ") {
            v := strings.TrimPrefix(line, "IPv4: ")
            if v != "NONE" {
                result.IPv4 = v
            }
        } else if strings.HasPrefix(line, "IPv6: ") {
            v := strings.TrimPrefix(line, "IPv6: ")
            if v != "NONE" {
                result.IPv6 = v
            }
        }
    }
    return result, scanner.Err()
}

func main() {
    ips, err := getBothIPs()
    if err != nil {
        fmt.Printf("Error: %v\n", err)
        return
    }
    fmt.Printf("IPv4: %s\n", ips.IPv4) // IPv4: 203.0.113.42
    fmt.Printf("IPv6: %s\n", ips.IPv6) // IPv6:  (empty if unavailable)
}

Handling rate limits

The API returns 429 Too Many Requests with a Retry-After header if the same IP sends requests too frequently. A robust wrapper with retry logic:

func getPublicIPWithRetry(maxRetries int) (string, error) {
    client := &http.Client{Timeout: 10 * time.Second}

    for attempt := 0; attempt <= maxRetries; attempt++ {
        resp, err := client.Get("https://ipv4.ippubblico.org/")
        if err != nil {
            return "", err
        }

        if resp.StatusCode == http.StatusTooManyRequests {
            retryAfter := resp.Header.Get("Retry-After")
            wait := 20 * time.Second
            if secs, err := time.ParseDuration(retryAfter + "s"); err == nil {
                wait = secs
            }
            resp.Body.Close()
            if attempt < maxRetries {
                time.Sleep(wait)
                continue
            }
            return "", fmt.Errorf("rate limited after %d attempts", maxRetries)
        }

        body, err := io.ReadAll(resp.Body)
        resp.Body.Close()
        if err != nil {
            return "", err
        }
        return strings.TrimSpace(string(body)), nil
    }
    return "", fmt.Errorf("max retries exceeded")
}

Quick reference

Need	Endpoint	Response
IPv4 only	`https://ipv4.ippubblico.org/`	`203.0.113.42`
IPv6 only	`https://ipv6.ippubblico.org/`	`2001:db8::1` or `NONE`
Both protocols	`https://ippubblico.org/?text=1`	`IPv4: x\nIPv6: x`
Full geolocation	`https://ippubblico.org/?api=1`	JSON with country, city, ISP

Full API documentation: ippubblico.org/docs.html

Conclusion

Go's standard library handles all the HTTP and JSON work cleanly — the code you write for IP detection in Go is shorter and more explicit than most other languages, with no hidden magic. The DDNS updater compiles to a single static binary that you can drop on any Linux server or embedded device without installing a runtime.

The caching client and Gin middleware patterns shown here are production-ready starting points — they handle concurrent access correctly with sync.RWMutex and fail gracefully when the API is unavailable.

Building something with Go and IPPubblico? Share your use case in the comments.

How to build a DDNS updater with no API key

Vix — Wed, 24 Jun 2026 14:05:51 +0000

How to build a DDNS updater with no API key

Dynamic DNS (DDNS) is one of those problems that sounds simple — keep a DNS record pointing at your current IP — but tends to involve more moving parts than expected. Most solutions require creating an account, generating an API key, and depending on a third-party service to detect your own IP address. This article shows how to build a complete DDNS updater that detects your public IP without any API key, using IPPubblico.org as the IP detection layer.

The DDNS update step (writing to your DNS provider) still requires your DNS provider's credentials, but the IP detection part — which is what breaks or goes stale most often — is completely key-free.

How DDNS updaters work

The basic loop is always the same:

Get your current public IP address
Compare it to the last known IP (stored locally or retrieved from DNS)
If it changed, update the DNS record
Wait and repeat

The IP detection step (step 1) is where most updaters introduce unnecessary dependencies. Many use ip-api.com, ipify.org, or similar services that require rate limit management, API keys for higher tiers, or have unreliable uptime. IPPubblico returns a plain text response with no authentication overhead — ideal for scripts that run every few minutes.

Shell script (Linux / OpenWRT / router firmware)

The most portable version. Runs on any system with curl and a cron daemon — including OpenWRT routers, NAS devices, and embedded Linux boards.

#!/bin/sh
# ddns_updater.sh
# Detects public IP change and updates a Cloudflare DNS record

# --- Configuration ---
CF_API_TOKEN="your_cloudflare_api_token"
CF_ZONE_ID="your_zone_id"
CF_RECORD_ID="your_record_id"
CF_RECORD_NAME="home.yourdomain.com"
IP_CACHE_FILE="/tmp/ddns_last_ip.txt"
LOG_FILE="/var/log/ddns_updater.log"

# --- Functions ---
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE"
}

get_public_ip() {
    curl -s --max-time 10 https://ipv4.ippubblico.org/
}

update_cloudflare() {
    local NEW_IP="$1"
    curl -s -X PUT \
        "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/dns_records/${CF_RECORD_ID}" \
        -H "Authorization: Bearer ${CF_API_TOKEN}" \
        -H "Content-Type: application/json" \
        --data "{\"type\":\"A\",\"name\":\"${CF_RECORD_NAME}\",\"content\":\"${NEW_IP}\",\"ttl\":60}"
}

# --- Main ---
CURRENT_IP=$(get_public_ip)

if [ -z "$CURRENT_IP" ]; then
    log "ERROR: Failed to get public IP"
    exit 1
fi

LAST_IP=""
if [ -f "$IP_CACHE_FILE" ]; then
    LAST_IP=$(cat "$IP_CACHE_FILE")
fi

if [ "$CURRENT_IP" = "$LAST_IP" ]; then
    log "IP unchanged: $CURRENT_IP"
    exit 0
fi

log "IP changed: $LAST_IP -> $CURRENT_IP. Updating DNS..."

RESULT=$(update_cloudflare "$CURRENT_IP")

if echo "$RESULT" | grep -q '"success":true'; then
    echo "$CURRENT_IP" > "$IP_CACHE_FILE"
    log "DNS updated successfully to $CURRENT_IP"
else
    log "ERROR: DNS update failed. Response: $RESULT"
    exit 1
fi

Add to cron (runs every 5 minutes):

*/5 * * * * /usr/local/bin/ddns_updater.sh

Python (cross-platform)

A more robust version with proper error handling, structured logging, and support for multiple DNS providers.

#!/usr/bin/env python3
# ddns_updater.py

import requests
import json
import logging
import time
from pathlib import Path
from dataclasses import dataclass
from typing import Optional

# --- Configuration ---
CLOUDFLARE_API_TOKEN = "your_cloudflare_api_token"
CLOUDFLARE_ZONE_ID   = "your_zone_id"
CLOUDFLARE_RECORD_ID = "your_record_id"
RECORD_NAME          = "home.yourdomain.com"
CACHE_FILE           = Path("/tmp/ddns_last_ip.txt")
CHECK_INTERVAL       = 300  # seconds

logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s %(levelname)s %(message)s',
    handlers=[
        logging.FileHandler('/var/log/ddns_updater.log'),
        logging.StreamHandler()
    ]
)
log = logging.getLogger(__name__)


def get_public_ip() -> Optional[str]:
    """Get current public IPv4 address — no API key required."""
    try:
        res = requests.get('https://ipv4.ippubblico.org/', timeout=10)
        res.raise_for_status()
        return res.text.strip()
    except requests.RequestException as e:
        log.error(f"Failed to get public IP: {e}")
        return None


def get_cached_ip() -> Optional[str]:
    try:
        return CACHE_FILE.read_text().strip()
    except FileNotFoundError:
        return None


def save_ip(ip: str) -> None:
    CACHE_FILE.write_text(ip)


def update_cloudflare(new_ip: str) -> bool:
    """Update an A record on Cloudflare."""
    url = f"https://api.cloudflare.com/client/v4/zones/{CLOUDFLARE_ZONE_ID}/dns_records/{CLOUDFLARE_RECORD_ID}"
    headers = {
        "Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}",
        "Content-Type": "application/json",
    }
    payload = {
        "type": "A",
        "name": RECORD_NAME,
        "content": new_ip,
        "ttl": 60,
    }
    try:
        res = requests.put(url, headers=headers, json=payload, timeout=10)
        data = res.json()
        if data.get("success"):
            return True
        log.error(f"Cloudflare API error: {data.get('errors')}")
        return False
    except requests.RequestException as e:
        log.error(f"Cloudflare request failed: {e}")
        return False


def check_and_update() -> None:
    current_ip = get_public_ip()
    if not current_ip:
        return

    last_ip = get_cached_ip()

    if current_ip == last_ip:
        log.info(f"IP unchanged: {current_ip}")
        return

    log.info(f"IP changed: {last_ip or 'unknown'} → {current_ip}")

    if update_cloudflare(current_ip):
        save_ip(current_ip)
        log.info(f"DNS updated successfully to {current_ip}")
    else:
        log.error("DNS update failed")


if __name__ == "__main__":
    log.info("DDNS updater started")
    while True:
        check_and_update()
        time.sleep(CHECK_INTERVAL)

Run as a systemd service:

[Unit]
Description=DDNS Updater
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/bin/python3 /usr/local/bin/ddns_updater.py
Restart=on-failure
RestartSec=30

[Install]
WantedBy=multi-user.target

Node.js

// ddns_updater.js — requires Node 18+
import fs   from 'fs/promises';
import path from 'path';

const CF_API_TOKEN  = 'your_cloudflare_api_token';
const CF_ZONE_ID    = 'your_zone_id';
const CF_RECORD_ID  = 'your_record_id';
const RECORD_NAME   = 'home.yourdomain.com';
const CACHE_FILE    = '/tmp/ddns_last_ip.txt';
const INTERVAL_MS   = 5 * 60 * 1000;

async function getPublicIP() {
  const res = await fetch('https://ipv4.ippubblico.org/', {
    signal: AbortSignal.timeout(10000)
  });
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  return (await res.text()).trim();
}

async function getCachedIP() {
  try { return (await fs.readFile(CACHE_FILE, 'utf-8')).trim(); }
  catch { return null; }
}

async function updateCloudflare(ip) {
  const res = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/dns_records/${CF_RECORD_ID}`,
    {
      method: 'PUT',
      headers: {
        'Authorization': `Bearer ${CF_API_TOKEN}`,
        'Content-Type':  'application/json',
      },
      body: JSON.stringify({ type: 'A', name: RECORD_NAME, content: ip, ttl: 60 }),
      signal: AbortSignal.timeout(10000),
    }
  );
  const data = await res.json();
  return data.success === true;
}

async function check() {
  try {
    const current = await getPublicIP();
    const last    = await getCachedIP();

    if (current === last) {
      console.log(`[${new Date().toISOString()}] IP unchanged: ${current}`);
      return;
    }

    console.log(`[${new Date().toISOString()}] IP changed: ${last ?? 'unknown'} → ${current}`);

    if (await updateCloudflare(current)) {
      await fs.writeFile(CACHE_FILE, current, 'utf-8');
      console.log(`[${new Date().toISOString()}] DNS updated to ${current}`);
    } else {
      console.error('DNS update failed');
    }
  } catch (err) {
    console.error('Error:', err.message);
  }
}

check();
setInterval(check, INTERVAL_MS);

Go

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "os"
    "strings"
    "time"
)

const (
    cfAPIToken  = "your_cloudflare_api_token"
    cfZoneID    = "your_zone_id"
    cfRecordID  = "your_record_id"
    recordName  = "home.yourdomain.com"
    cacheFile   = "/tmp/ddns_last_ip.txt"
    checkInterval = 5 * time.Minute
)

func getPublicIP() (string, error) {
    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Get("https://ipv4.ippubblico.org/")
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    return strings.TrimSpace(string(body)), nil
}

func getCachedIP() string {
    data, err := os.ReadFile(cacheFile)
    if err != nil {
        return ""
    }
    return strings.TrimSpace(string(data))
}

func updateCloudflare(ip string) error {
    url := fmt.Sprintf(
        "https://api.cloudflare.com/client/v4/zones/%s/dns_records/%s",
        cfZoneID, cfRecordID,
    )
    payload := map[string]interface{}{
        "type":    "A",
        "name":    recordName,
        "content": ip,
        "ttl":     60,
    }
    body, _ := json.Marshal(payload)

    req, _ := http.NewRequest("PUT", url, bytes.NewReader(body))
    req.Header.Set("Authorization", "Bearer "+cfAPIToken)
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{Timeout: 10 * time.Second}
    resp, err := client.Do(req)
    if err != nil {
        return err
    }
    defer resp.Body.Close()

    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    if result["success"] != true {
        return fmt.Errorf("cloudflare error: %v", result["errors"])
    }
    return nil
}

func checkAndUpdate() {
    current, err := getPublicIP()
    if err != nil {
        log.Printf("Failed to get IP: %v", err)
        return
    }

    last := getCachedIP()
    if current == last {
        log.Printf("IP unchanged: %s", current)
        return
    }

    log.Printf("IP changed: %s → %s", last, current)

    if err := updateCloudflare(current); err != nil {
        log.Printf("DNS update failed: %v", err)
        return
    }

    os.WriteFile(cacheFile, []byte(current), 0644)
    log.Printf("DNS updated to %s", current)
}

func main() {
    log.Println("DDNS updater started")
    checkAndUpdate()
    for range time.Tick(checkInterval) {
        checkAndUpdate()
    }
}

How the IP detection works

All examples use https://ipv4.ippubblico.org/ — a dedicated endpoint that forces an IPv4 connection and returns nothing but the bare IP address as plain text. This makes parsing trivial in every language:

203.0.113.42

No JSON to unwrap, no status fields to check, no authentication headers. For a script that runs every 5 minutes, this simplicity matters — fewer things to break.

If you want to verify DNS propagation after an update (checking that the IP in the DNS matches your current IP), a quick way to confirm your current IP without a DNS lookup:

CURRENT=$(curl -s https://ipv4.ippubblico.org/)
DNS_IP=$(dig +short home.yourdomain.com @8.8.8.8)
echo "Current IP : $CURRENT"
echo "DNS record : $DNS_IP"
[ "$CURRENT" = "$DNS_IP" ] && echo "In sync" || echo "Update pending"

What about IPv6?

If your setup supports IPv6 and your DNS provider supports AAAA records, you can detect the IPv6 address the same way:

IPV6=$(curl -s https://ipv6.ippubblico.org/)
# Returns the IPv6 address or nothing if not available

If the endpoint returns an empty response or fails to connect, the client has no IPv6 connectivity — handle it gracefully and fall back to IPv4 only.

Summary

Language	Dependency	Runs as
Shell	`curl`	cron / init script
Python	`requests`	systemd service / cron
Node.js	none (native fetch)	systemd service / PM2
Go	none (stdlib)	systemd service / binary

IP detection across all examples: https://ipv4.ippubblico.org/ — no API key, no account, plain text response.

Full documentation: ippubblico.org/docs.html

Which DNS provider are you using for DDNS? Share your setup in the comments.

Getting the public IP in Node.js and Express — no API key, no rate limits, no hassle

Vix — Mon, 22 Jun 2026 18:47:49 +0000

Getting the public IP in Node.js and Express — no API key, no rate limits, no hassle

Node.js is one of the most popular runtimes for building APIs, backend services, and CLI tools that need to know about network context. This article covers how to get the public IP address — your own server's or your client's — across the most common Node.js scenarios, using IPPubblico.org: free, no key required, HTTPS, CORS enabled.

Use case 1 — Your server's own public IP (script / CLI)

The simplest case: a Node.js script that needs to know its own public IP. Useful in deployment scripts, diagnostics, DDNS updaters, or any automation that needs to report its own address.

With fetch (Node 18+):

async function getPublicIP() {
  try {
    const res = await fetch('https://ipv4.ippubblico.org/', { signal: AbortSignal.timeout(5000) });
    if (!res.ok) throw new Error(`HTTP ${res.status}`);
    return (await res.text()).trim();
  } catch (err) {
    console.error('Failed to get public IP:', err.message);
    return null;
  }
}

const ip = await getPublicIP();
console.log('Public IP:', ip); // 203.0.113.42

With axios:

import axios from 'axios';

async function getPublicIP() {
  try {
    const { data } = await axios.get('https://ipv4.ippubblico.org/', { timeout: 5000 });
    return data.trim();
  } catch (err) {
    console.error('Failed to get public IP:', err.message);
    return null;
  }
}

With node-fetch (older Node versions):

import fetch from 'node-fetch';

async function getPublicIP() {
  const res = await fetch('https://ipv4.ippubblico.org/');
  return (await res.text()).trim();
}

Use case 2 — Full geolocation data

When you need country, city, ISP and timezone in addition to the IP:

async function getIPInfo() {
  const res = await fetch('https://ippubblico.org/?api=1', {
    signal: AbortSignal.timeout(5000)
  });
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  const data = await res.json();

  return {
    ip:          data.ip,
    country:     data.geo?.country,
    countryCode: data.geo?.country_code,
    city:        data.geo?.city,
    region:      data.geo?.region,
    isp:         data.isp,
    timezone:    data.timezone,
    lat:         data.geo?.lat,
    lon:         data.geo?.lon,
  };
}

const info = await getIPInfo();
console.log(info);
// {
//   ip: '203.0.113.42',
//   country: 'Italy',
//   countryCode: 'IT',
//   city: 'Milan',
//   region: 'Lombardy',
//   isp: 'Telecom Italia',
//   timezone: 'Europe/Rome',
//   lat: 45.4654,
//   lon: 9.1859
// }

Use case 3 — Express middleware for client IP geolocation

The most common Express scenario: detecting where your users are connecting from. This middleware resolves the client's IP using IPPubblico and attaches the result to req.ipInfo for use in any route.

import express from 'express';

const app = express();

// Simple in-memory cache to avoid hitting the API on every request
const geoCache = new Map();
const CACHE_TTL = 60 * 60 * 1000; // 1 hour

async function resolveIP(ip) {
  const cached = geoCache.get(ip);
  if (cached && Date.now() - cached.ts < CACHE_TTL) {
    return cached.data;
  }

  try {
    const res = await fetch(`https://ippubblico.org/?api=1`, {
      signal: AbortSignal.timeout(3000)
    });
    const data = await res.json();
    const result = {
      ip:          data.ip,
      country:     data.geo?.country,
      countryCode: data.geo?.country_code,
      city:        data.geo?.city,
      isp:         data.isp,
      timezone:    data.timezone,
    };
    geoCache.set(ip, { data: result, ts: Date.now() });
    return result;
  } catch {
    return null;
  }
}

// Middleware
app.use(async (req, res, next) => {
  const forwarded = req.headers['x-forwarded-for'];
  const clientIP  = forwarded ? forwarded.split(',')[0].trim() : req.socket.remoteAddress;
  req.clientIP  = clientIP;
  req.ipInfo    = await resolveIP(clientIP);
  next();
});

// Use in any route
app.get('/hello', (req, res) => {
  const country = req.ipInfo?.country ?? 'Unknown';
  res.json({
    message: `Hello from ${country}!`,
    ip:      req.clientIP,
    info:    req.ipInfo,
  });
});

app.listen(3000);

Use case 4 — Country-based access control

Restricting or customising content based on country — without a paid API key:

const BLOCKED_COUNTRIES = ['XX', 'YY']; // ISO country codes
const PREMIUM_COUNTRIES  = ['US', 'GB', 'DE', 'FR', 'IT'];

app.use(async (req, res, next) => {
  const forwarded = req.headers['x-forwarded-for'];
  const ip = forwarded ? forwarded.split(',')[0].trim() : req.socket.remoteAddress;

  try {
    const geoRes = await fetch('https://ippubblico.org/?api=1', {
      signal: AbortSignal.timeout(3000)
    });
    const data = await geoRes.json();
    req.countryCode = data.geo?.country_code ?? null;
  } catch {
    req.countryCode = null;
  }
  next();
});

app.get('/content', (req, res) => {
  if (BLOCKED_COUNTRIES.includes(req.countryCode)) {
    return res.status(403).json({ error: 'Not available in your region' });
  }

  const isPremiumRegion = PREMIUM_COUNTRIES.includes(req.countryCode);
  res.json({
    content:  'Here is your content',
    tier:     isPremiumRegion ? 'premium' : 'standard',
    currency: req.countryCode === 'GB' ? 'GBP' : 'EUR',
  });
});

Use case 5 — DDNS updater script

A complete Node.js DDNS updater that checks the public IP every 5 minutes and logs when it changes:

import fs   from 'fs/promises';
import path from 'path';

const CACHE_FILE  = '/tmp/last_known_ip.txt';
const CHECK_INTERVAL = 5 * 60 * 1000; // 5 minutes

async function getPublicIP() {
  const res = await fetch('https://ipv4.ippubblico.org/', {
    signal: AbortSignal.timeout(5000)
  });
  return (await res.text()).trim();
}

async function getLastKnownIP() {
  try {
    return (await fs.readFile(CACHE_FILE, 'utf-8')).trim();
  } catch {
    return null;
  }
}

async function saveIP(ip) {
  await fs.writeFile(CACHE_FILE, ip, 'utf-8');
}

async function updateDDNS(newIP) {
  // Add your DDNS provider API call here
  console.log(`[DDNS] Updating record to ${newIP}`);
}

async function check() {
  try {
    const currentIP  = await getPublicIP();
    const lastKnownIP = await getLastKnownIP();

    if (currentIP !== lastKnownIP) {
      console.log(`[IP changed] ${lastKnownIP ?? 'unknown'} → ${currentIP}`);
      await updateDDNS(currentIP);
      await saveIP(currentIP);
    } else {
      console.log(`[IP unchanged] ${currentIP}`);
    }
  } catch (err) {
    console.error('[Error]', err.message);
  }
}

// Run immediately then every 5 minutes
check();
setInterval(check, CHECK_INTERVAL);

Use case 6 — IPv4 and IPv6 detection

When you need to know both protocols:

async function getBothIPs() {
  const res = await fetch('https://ippubblico.org/?text=1', {
    signal: AbortSignal.timeout(5000)
  });
  const text = await res.text();
  const lines = text.trim().split('\n');

  const parse = (line, prefix) => {
    const val = line.replace(prefix, '').trim();
    return val === 'NONE' ? null : val;
  };

  return {
    ipv4: parse(lines[0], 'IPv4:'),
    ipv6: parse(lines[1], 'IPv6:'),
  };
}

const ips = await getBothIPs();
console.log(ips);
// { ipv4: '203.0.113.42', ipv6: null }
// or
// { ipv4: '203.0.113.42', ipv6: '2001:db8::1' }

Handling rate limits

If your application makes many requests from the same IP in a short period, the API responds with 429 Too Many Requests and a Retry-After header. A robust fetch wrapper:

async function fetchWithRetry(url, maxRetries = 2) {
  for (let attempt = 0; attempt <= maxRetries; attempt++) {
    const res = await fetch(url, { signal: AbortSignal.timeout(5000) });

    if (res.status === 429) {
      const retryAfter = parseInt(res.headers.get('Retry-After') ?? '20', 10);
      console.warn(`Rate limited. Waiting ${retryAfter}s...`);
      await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
      continue;
    }

    if (!res.ok) throw new Error(`HTTP ${res.status}`);
    return res;
  }
  throw new Error('Max retries exceeded');
}

// Usage
const res  = await fetchWithRetry('https://ippubblico.org/?api=1');
const data = await res.json();

In practice, caching results (as shown in the Express middleware above) eliminates most rate limit concerns.

Quick reference

Need	Endpoint	Response
IPv4 only	`https://ipv4.ippubblico.org/`	`203.0.113.42`
IPv6 only	`https://ipv6.ippubblico.org/`	`2001:db8::1` or `NONE`
Both protocols	`https://ippubblico.org/?text=1`	`IPv4: x\nIPv6: x`
Full geolocation	`https://ippubblico.org/?api=1`	JSON with country, city, ISP

Full API documentation: ippubblico.org/docs.html

Conclusion

IPPubblico covers Node.js use cases from a one-liner in a CLI script to a full Express middleware with caching and retry logic. The native fetch API available since Node 18 makes the integration particularly clean — no extra dependencies for the basic case.

The DDNS updater pattern is worth bookmarking: it's a complete, production-ready script that works on any server or VPS with Node.js installed, handling IP change detection, persistence, and error recovery in under 50 lines.

Using this in a Node.js project? Share what you built in the comments.

IPv4 vs IPv6 in 2026 — what every developer should know

Vix — Fri, 19 Jun 2026 10:41:38 +0000

IPv4 vs IPv6 in 2026 — what every developer should know

For most of the last decade, IPv6 felt like a topic you could safely ignore. "Still mostly IPv4 out there" was a reasonable excuse. That excuse stopped being true in 2026.

In March 2026, native IPv6 access to Google exceeded 50% globally for the first time in the 18 years Google has tracked this data. Around the same time, IPv6 overtook IPv4 as the majority protocol for global internet traffic as a whole. If you're building anything that touches the network — a backend service, a mobile app, an IoT device — this is no longer a future problem. It's a today problem.

This article covers what changed, why it matters for how you write code, and practical examples for detecting and handling both protocols correctly.

Why this happened now

IPv6 has existed since 1998. The slow adoption for most of its life wasn't a technical failure — it was an economic one. IPv4 addresses, while exhausted, kept getting recycled, traded, and NAT'd around for years longer than anyone expected. Migrating an entire network stack costs money and carries risk; as long as IPv4 kept limping along, there was no urgent reason to switch.

Three forces changed the calculus:

Mobile carriers went IPv6-first. Akamai data shows 88.4% of T-Mobile's network running on IPv6, with AT&T at 74% and Verizon at 74.8%. Most phone users today are on IPv6 without knowing it.

IoT made IPv4 impractical at scale. The number of IoT devices grew from roughly 15 billion in 2015 to over 75 billion in 2025, and these devices increasingly default to IPv6 because it removes the need to manage NAT rules and port forwarding for every single device.

Adoption is wildly uneven by country. France sits at 73% IPv6 adoption, India at 72%, Saudi Arabia at 65% — while Italy is at 17%, Spain at 10%, and Egypt at 4%. If your users are concentrated in IPv6-heavy regions, you're already serving majority-IPv6 traffic whether you've planned for it or not.

What actually changes for you as a developer

IPv6 isn't "IPv4 but longer." A few practical differences matter immediately:

No more NAT assumptions. With IPv4, most consumer devices sit behind NAT, so the IP you see is shared across a household or office. With IPv6, every device commonly gets its own globally routable address. This changes how you think about rate limiting, abuse detection, and geolocation — one IP no longer reliably maps to "one network", it often maps to "one device."

Address format is different everywhere. 2001:db8::1 instead of 203.0.113.42. This breaks naive regex validation, log parsers, and URL construction (IPv6 literals in URLs need brackets: https://[2001:db8::1]:8080/).

Dual-stack is the norm, not the exception. Most networks today run both protocols simultaneously. Your server, your client libraries, and your monitoring all need to handle a connection coming in on either protocol gracefully — not as an edge case.

Detecting IPv4 vs IPv6 in your stack

Here's how to handle both protocols correctly across common languages and frameworks.

JavaScript / Node.js

function getIPVersion(ip) {
  if (ip.includes(':')) return 'IPv6';
  if (ip.includes('.')) return 'IPv4';
  return 'unknown';
}

// Express middleware to log both correctly
app.use((req, res, next) => {
  const ip = req.ip; // may be IPv4 or IPv6 depending on connection
  console.log(`${getIPVersion(ip)} request from ${ip}`);
  next();
});

A common bug: Express and many proxies report IPv4 addresses as IPv6-mapped, like ::ffff:203.0.113.42. Strip the prefix before doing anything with it:

function normalizeIP(ip) {
  if (ip.startsWith('::ffff:')) {
    return ip.substring(7); // back to plain IPv4
  }
  return ip;
}

Python

import ipaddress

def get_ip_version(ip: str) -> str:
    try:
        addr = ipaddress.ip_address(ip)
        return f"IPv{addr.version}"
    except ValueError:
        return "invalid"

print(get_ip_version("203.0.113.42"))      # IPv4
print(get_ip_version("2001:db8::1"))       # IPv6

ipaddress is in the standard library and handles validation, version detection, and even subnet math — no need for regex.

Go

package main

import (
    "fmt"
    "net"
)

func getIPVersion(ipStr string) string {
    ip := net.ParseIP(ipStr)
    if ip == nil {
        return "invalid"
    }
    if ip.To4() != nil {
        return "IPv4"
    }
    return "IPv6"
}

func main() {
    fmt.Println(getIPVersion("203.0.113.42"))  // IPv4
    fmt.Println(getIPVersion("2001:db8::1"))   // IPv6
}

PHP

function getIPVersion(string $ip): string {
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
        return 'IPv4';
    }
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
        return 'IPv6';
    }
    return 'invalid';
}

Detecting client IP and protocol from the browser

If you need to know whether your visitor is reaching you over IPv4 or IPv6 (useful for diagnostics, dual-stack debugging, or simply curiosity), the cleanest approach is hitting protocol-specific endpoints — not parsing user agent strings or making assumptions.

IPPubblico.org exposes dedicated subdomains for exactly this:

// Forces an IPv4-only connection and returns the IPv4 address
fetch('https://ipv4.ippubblico.org/')
  .then(res => res.text())
  .then(ip => console.log('IPv4:', ip.trim()));

// Forces an IPv6-only connection — fails gracefully if the client has no IPv6
fetch('https://ipv6.ippubblico.org/')
  .then(res => res.text())
  .then(ip => console.log('IPv6:', ip.trim()))
  .catch(() => console.log('No IPv6 connectivity'));

Or get both in one call:

fetch('https://ippubblico.org/?text=1')
  .then(res => res.text())
  .then(text => {
    const lines = text.trim().split('\n');
    console.log(lines[0]); // IPv4: x.x.x.x or NONE
    console.log(lines[1]); // IPv6: x or NONE
  });

This pattern is genuinely useful: if ipv6.ippubblico.org times out or fails, you know definitively that the client has no IPv6 path to the public internet — not just that your app didn't request it.

Common pitfalls

Storing IPs as 32-bit integers. A classic IPv4-era optimization that breaks completely with IPv6. If your schema has an INT UNSIGNED column for IP storage, it cannot hold an IPv6 address. Use VARCHAR(45) or a native INET/CIDR type if your database supports one (PostgreSQL does).

Regex-based IP validation. Most handwritten IPv4 regexes don't even attempt IPv6, and IPv6's flexible notation (leading zero compression, :: shorthand, embedded IPv4) makes a correct regex genuinely hard to write by hand. Use your language's built-in IP parsing library instead — ipaddress in Python, net.ParseIP in Go, inet_pton in C, FILTER_VALIDATE_IP in PHP.

Rate limiting by IP alone. Since IPv6 commonly gives each device its own address while IPv4 often shares one address across many users behind NAT, identical rate-limiting logic produces very different real-world behavior depending on which protocol a request arrives on. A single aggressive IPv6 client looks like one bad actor; a misbehaving app on a shared IPv4 NAT can look like — and inadvertently punish — hundreds of innocent users at once.

CIDR notation differences. IPv4 subnets you're used to (/24, /16) map to wildly different scales in IPv6, where /64 is the standard allocation for a single network segment — already larger than the entire IPv4 address space.

Should you do anything about this right now?

If your stack already uses standard library IP parsing and your database can store variable-length strings, you're probably fine technically — dual-stack support is mostly already there in modern frameworks by default.

What's worth auditing:

Any handwritten IP validation or parsing logic
Database columns storing IPs as fixed-size integers
Rate limiting or abuse detection logic that assumes IPv4-style address sharing
Log analysis tools or dashboards that choke on the longer IPv6 format
Any hardcoded assumption that "an IP" is 4 bytes

None of this requires a rewrite. It requires checking that the assumptions baked into older code still hold — and increasingly, for a majority of your traffic, they don't.

Quick reference

Task	IPv4	IPv6
Example address	`203.0.113.42`	`2001:db8::1`
URL with port	`203.0.113.42:8080`	`[2001:db8::1]:8080`
Typical subnet	`/24` (256 addresses)	`/64` (≈1.8×10¹⁹ addresses)
NAT behavior	Usually shared across users	Usually one address per device
Detect with IPPubblico	`https://ipv4.ippubblico.org/`	`https://ipv6.ippubblico.org/`

Conclusion

IPv6 crossing the 50% threshold in March 2026 is the kind of milestone that's easy to miss because nothing visibly "switched over" — there was no flag day, no announcement, just a slow curve that quietly crossed the midpoint. But for anyone writing code that touches the network, the practical implication is concrete: code that silently assumes IPv4 is now wrong for roughly half of real-world traffic, and that share is still climbing.

The fix isn't dramatic. Use your language's built-in IP libraries, store IPs as strings, and stop assuming one IP equals one user. The protocol your code runs on increasingly isn't your choice to make — it's the network's.

Have you run into IPv6-related bugs in production? Share them in the comments — the edge cases are usually the most instructive part.

Getting the public IP in Python — scripts, Django, FastAPI

Vix — Mon, 15 Jun 2026 06:17:15 +0000

Getting the public IP in Python — scripts, Django, FastAPI

Whether you're writing a quick script, building a Django web app, or designing a FastAPI microservice, knowing the public IP of your server or client is a recurring need. This article covers all three scenarios with practical code, using IPPubblico.org — a free API with no key required, HTTPS, and CORS enabled.

Why IPPubblico?

Before diving into code, here's a quick summary of why it's worth using:

No API key — works immediately, zero setup
HTTPS only — secure by default
Plain text endpoint — no parsing for simple cases
Full JSON endpoint — city, country, ISP, ASN, timezone when needed
No hard rate limit — soft limiting applies for abuse prevention
Commercial use allowed on the free tier

Use case 1 — Simple script with `requests`

The most common scenario: a standalone script that needs to know its own public IP.

import requests

def get_public_ip():
    try:
        response = requests.get(
            'https://ipv4.ippubblico.org/',
            timeout=5
        )
        response.raise_for_status()
        return response.text.strip()
    except requests.RequestException as e:
        print(f"Failed to get IP: {e}")
        return None

if __name__ == '__main__':
    ip = get_public_ip()
    print(f"Public IP: {ip}")
    # Public IP: 203.0.113.42

Use case 2 — Full geolocation with `requests`

When you need country, city, ISP and timezone in addition to the IP:

import requests
from dataclasses import dataclass
from typing import Optional

@dataclass
class IPInfo:
    ip: str
    country: Optional[str]
    country_code: Optional[str]
    city: Optional[str]
    region: Optional[str]
    isp: Optional[str]
    timezone: Optional[str]
    lat: Optional[float]
    lon: Optional[float]

def get_ip_info(ip: str = None) -> Optional[IPInfo]:
    """
    Get geolocation info for an IP address.
    If ip is None, returns info for the current public IP.
    """
    url = 'https://ippubblico.org/?api=1'
    if ip:
        url += f'&ip={ip}'

    try:
        response = requests.get(url, timeout=5)
        response.raise_for_status()
        data = response.json()

        if data.get('status') != 'ok':
            return None

        geo = data.get('geo', {})
        return IPInfo(
            ip=data.get('ip', ''),
            country=geo.get('country'),
            country_code=geo.get('country_code'),
            city=geo.get('city'),
            region=geo.get('region'),
            isp=data.get('isp'),
            timezone=data.get('timezone'),
            lat=geo.get('lat'),
            lon=geo.get('lon'),
        )
    except requests.RequestException as e:
        print(f"Request failed: {e}")
        return None

if __name__ == '__main__':
    info = get_ip_info()
    if info:
        print(f"IP:       {info.ip}")
        print(f"Country:  {info.country} ({info.country_code})")
        print(f"City:     {info.city}, {info.region}")
        print(f"ISP:      {info.isp}")
        print(f"Timezone: {info.timezone}")

Use case 3 — Async script with `httpx`

For async Python scripts using httpx:

import asyncio
import httpx

async def get_public_ip() -> str | None:
    async with httpx.AsyncClient(timeout=5.0) as client:
        try:
            response = await client.get('https://ipv4.ippubblico.org/')
            response.raise_for_status()
            return response.text.strip()
        except httpx.HTTPError as e:
            print(f"Failed to get IP: {e}")
            return None

async def get_ip_info() -> dict | None:
    async with httpx.AsyncClient(timeout=5.0) as client:
        try:
            response = await client.get('https://ippubblico.org/?api=1')
            response.raise_for_status()
            data = response.json()
            return data if data.get('status') == 'ok' else None
        except httpx.HTTPError as e:
            print(f"Failed to get IP info: {e}")
            return None

async def main():
    ip = await get_public_ip()
    print(f"Public IP: {ip}")

    info = await get_ip_info()
    if info:
        print(f"Country: {info['geo']['country']}")
        print(f"City:    {info['geo']['city']}")

asyncio.run(main())

Use case 4 — Django middleware for country detection

A Django middleware that detects the user's country on every request and adds it to request.country_code. Useful for region-based content, currency selection, or logging.

# myapp/middleware.py

import requests
from django.core.cache import cache

CACHE_TIMEOUT = 3600  # 1 hour per IP

class CountryDetectionMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        client_ip = self._get_client_ip(request)
        request.client_ip = client_ip
        request.country_code = self._get_country(client_ip)
        response = self.get_response(request)
        return response

    def _get_client_ip(self, request):
        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
        if x_forwarded_for:
            return x_forwarded_for.split(',')[0].strip()
        return request.META.get('REMOTE_ADDR')

    def _get_country(self, ip: str) -> str | None:
        if not ip:
            return None

        cache_key = f'country_{ip}'
        cached = cache.get(cache_key)
        if cached:
            return cached

        try:
            response = requests.get(
                'https://ippubblico.org/?api=1',
                timeout=3
            )
            data = response.json()
            country_code = data.get('geo', {}).get('country_code')
            if country_code:
                cache.set(cache_key, country_code, CACHE_TIMEOUT)
            return country_code
        except Exception:
            return None

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'myapp.middleware.CountryDetectionMiddleware',  # add here
    # ... rest of middleware
]

Use it in any view:

# views.py

from django.http import JsonResponse

def my_view(request):
    return JsonResponse({
        'ip': request.client_ip,
        'country': request.country_code,
    })

Use case 5 — Django view with per-request geolocation

For cases where you need full geolocation data in a specific view, not globally:

# views.py

import requests
from django.http import JsonResponse
from django.views import View

class UserLocationView(View):
    def get(self, request):
        ip = request.META.get('HTTP_X_FORWARDED_FOR', '').split(',')[0].strip() \
             or request.META.get('REMOTE_ADDR')

        try:
            response = requests.get(
                'https://ippubblico.org/?api=1',
                timeout=5
            )
            data = response.json()
            geo = data.get('geo', {})

            return JsonResponse({
                'ip': data.get('ip'),
                'country': geo.get('country'),
                'country_code': geo.get('country_code'),
                'city': geo.get('city'),
                'timezone': data.get('timezone'),
            })
        except Exception as e:
            return JsonResponse({'error': str(e)}, status=500)

Use case 6 — FastAPI dependency injection

The cleanest FastAPI pattern: a reusable dependency that injects IP info into any route.

# dependencies.py

import httpx
from functools import lru_cache
from fastapi import Request, Depends
from typing import Optional
from pydantic import BaseModel

class GeoInfo(BaseModel):
    city: Optional[str] = None
    region: Optional[str] = None
    country: Optional[str] = None
    country_code: Optional[str] = None
    lat: Optional[float] = None
    lon: Optional[float] = None

class IPInfo(BaseModel):
    ip: str
    isp: Optional[str] = None
    timezone: Optional[str] = None
    geo: GeoInfo = GeoInfo()

def get_client_ip(request: Request) -> str:
    forwarded = request.headers.get('X-Forwarded-For')
    if forwarded:
        return forwarded.split(',')[0].strip()
    return request.client.host

async def get_ip_info(request: Request) -> Optional[IPInfo]:
    ip = get_client_ip(request)
    async with httpx.AsyncClient(timeout=5.0) as client:
        try:
            response = await client.get('https://ippubblico.org/?api=1')
            data = response.json()
            if data.get('status') == 'ok':
                return IPInfo(**{
                    'ip': data.get('ip', ip),
                    'isp': data.get('isp'),
                    'timezone': data.get('timezone'),
                    'geo': GeoInfo(**data.get('geo', {}))
                })
        except Exception:
            pass
    return None

Use in any route:

# main.py

from fastapi import FastAPI, Depends
from dependencies import IPInfo, get_ip_info

app = FastAPI()

@app.get('/location')
async def location(ip_info: IPInfo = Depends(get_ip_info)):
    if not ip_info:
        return {'error': 'Could not detect location'}
    return {
        'ip': ip_info.ip,
        'country': ip_info.geo.country,
        'city': ip_info.geo.city,
        'timezone': ip_info.timezone,
    }

Use case 7 — FastAPI with caching (Redis)

For high-traffic APIs, cache the geolocation result per IP to avoid repeated external calls:

# dependencies_cached.py

import httpx
import json
from fastapi import Request
from typing import Optional
import redis.asyncio as redis

redis_client = redis.Redis(host='localhost', port=6379, decode_responses=True)
CACHE_TTL = 3600  # 1 hour

async def get_ip_info_cached(request: Request) -> Optional[dict]:
    forwarded = request.headers.get('X-Forwarded-For')
    ip = forwarded.split(',')[0].strip() if forwarded else request.client.host

    cache_key = f'ipinfo:{ip}'
    cached = await redis_client.get(cache_key)
    if cached:
        return json.loads(cached)

    async with httpx.AsyncClient(timeout=5.0) as client:
        try:
            response = await client.get('https://ippubblico.org/?api=1')
            data = response.json()
            if data.get('status') == 'ok':
                await redis_client.setex(cache_key, CACHE_TTL, json.dumps(data))
                return data
        except Exception:
            pass
    return None

Handling rate limits

If your application makes many requests from the same IP in a short period, you may receive a 429 Too Many Requests response. The API returns a Retry-After header indicating how many seconds to wait:

import time
import requests

def get_ip_with_retry(max_retries: int = 3) -> str | None:
    for attempt in range(max_retries):
        response = requests.get(
            'https://ipv4.ippubblico.org/',
            timeout=5
        )

        if response.status_code == 200:
            return response.text.strip()

        if response.status_code == 429:
            retry_after = int(response.headers.get('Retry-After', 20))
            print(f"Rate limited. Waiting {retry_after}s before retry {attempt + 1}/{max_retries}")
            time.sleep(retry_after)
            continue

        response.raise_for_status()

    return None

In practice, caching results at the application level eliminates most rate limit concerns.

Quick reference

Need	Endpoint	Response
IPv4 only	`https://ipv4.ippubblico.org/`	`203.0.113.42`
IPv6 only	`https://ipv6.ippubblico.org/`	`2001:db8::1` or `NONE`
Both protocols	`https://ippubblico.org/?text=1`	`IPv4: x\nIPv6: x`
Full geolocation	`https://ippubblico.org/?api=1`	JSON with country, city, ISP

Full API documentation: ippubblico.org/docs.html

Conclusion

IPPubblico covers the full range of Python use cases — from a one-liner in a shell script to a properly typed FastAPI dependency with Redis caching. The consistent API across plain text and JSON endpoints means you can start simple and add complexity only when you need it.

The Django middleware and FastAPI dependency patterns shown here are production-ready starting points: they handle client IP extraction behind proxies, cache results to avoid redundant API calls, and fail gracefully when the external service is unavailable.

Using a different approach for IP detection in Python? Share it in the comments.

ip-api.com vs ipify vs IPPubblico — which free IP API should you use in 2026?

Vix — Fri, 12 Jun 2026 11:14:09 +0000

ip-api.com vs ipify vs IPPubblico — which free IP API should you use in 2026?

If you need a public IP detection or geolocation API for your project, three names come up repeatedly: ip-api.com, ipify, and IPPubblico. They are all free, they all work without much setup, and they all solve roughly the same problem — but in meaningfully different ways.

This article breaks down the real differences so you can pick the right tool for your use case.

Quick comparison

Feature	ip-api.com	ipify	IPPubblico
API key required	No (free tier)	No	No
HTTPS (free tier)	❌ HTTP only	✅	✅
CORS (free tier)	❌	✅	✅
Rate limit (free)	45 req/min	None stated	No hard limit*
Commercial use (free)	❌	✅	✅
Plain text endpoint	✅	✅	✅
IPv4 detection	✅	✅	✅
IPv6 detection	✅	✅	✅
Geolocation (city, region)	✅	❌	✅
ISP / ASN	✅	❌	✅
Timezone	✅	❌	✅
Interface languages	1 (English)	1 (English)	43
Local MaxMind DB	❌	❌	✅
Open source / self-hostable	❌	❌	❌

*Soft limiting applies for abuse prevention.

ip-api.com

ip-api has been around since 2012 and is one of the most referenced IP geolocation APIs in developer tutorials. It returns a rich JSON response with country, city, ISP, ASN, timezone, and more — all without requiring a key.

The catch: the free tier only works over HTTP, not HTTPS. This is a significant limitation for any frontend application, where mixed content policies will block the request outright in modern browsers. HTTPS is available on the paid Pro plan only.

CORS is also disabled on the free tier, making it unusable for direct browser calls without a proxy.

Rate limit: 45 requests per minute per IP. For most use cases this is fine, but it means a single active user hitting the API repeatedly will be throttled quickly.

Commercial use: explicitly prohibited on the free tier.

// HTTP only on free tier — will be blocked by browsers on HTTPS pages
fetch('http://ip-api.com/json')
  .then(res => res.json())
  .then(data => {
    console.log(data.country);    // "Italy"
    console.log(data.city);       // "Milan"
    console.log(data.isp);        // "Telecom Italia"
    console.log(data.timezone);   // "Europe/Rome"
  });

import requests

# works fine server-side where HTTPS is not required
response = requests.get('http://ip-api.com/json')
data = response.json()
print(data['country'])   # Italy
print(data['city'])      # Milan
print(data['isp'])       # Telecom Italia

Best for: server-side scripts and backend applications where HTTPS and CORS are not a concern, and commercial use is not required.

ipify

ipify does one thing and does it well: it returns your public IP address. Nothing more.

The API is extremely simple — a single endpoint, three response formats (plain text, JSON, JSONP), HTTPS enabled, CORS enabled, no key required. It has been running reliably for years and is widely used in scripts, CI/CD pipelines, and network tooling.

The limitation: ipify provides no geolocation data. You get the IP and nothing else. If you need country, city, or ISP, you need a second API call to a different service.

Rate limit: not officially stated. The service is designed for high volume and handles a very large number of requests globally, but there is no documented guarantee.

// plain text — simplest possible
fetch('https://api.ipify.org')
  .then(res => res.text())
  .then(ip => console.log(ip)); // "203.0.113.42"

// JSON format
fetch('https://api.ipify.org?format=json')
  .then(res => res.json())
  .then(data => console.log(data.ip)); // "203.0.113.42"

// IPv6
fetch('https://api6.ipify.org?format=json')
  .then(res => res.json())
  .then(data => console.log(data.ip));

import requests

ip = requests.get('https://api.ipify.org').text
print(ip)  # 203.0.113.42

# or JSON
data = requests.get('https://api.ipify.org?format=json').json()
print(data['ip'])

# shell — very common in scripts
curl https://api.ipify.org
# 203.0.113.42

Best for: getting the public IP address quickly in scripts, backend code, and CLI tools where geolocation is not needed.

IPPubblico

IPPubblico covers both use cases above in a single service: it has a plain text endpoint for simple IP detection and a full JSON endpoint for geolocation, both over HTTPS and with CORS enabled — all without an API key.

A few things distinguish it technically from the other two:

Local MaxMind database. Geolocation lookups are served from a local copy of the MaxMind GeoLite2 database, not from a third-party API chain. This means lower latency for the lookup and no dependency on upstream services.

Dedicated subdomains for protocol detection. ipv4.ippubblico.org forces an IPv4 connection and returns only the IPv4 address. ipv6.ippubblico.org does the same for IPv6. This is useful when you need to explicitly detect one protocol regardless of the client's default.

43 interface languages. The web interface and documentation are available in 43 languages, which is useful for projects targeting non-English-speaking markets.

Rate limit: No hard rate limit. Soft limiting applies for abuse
prevention on all endpoints, with a Retry-After header on 429
responses to guide clients on when to retry.

Commercial use: allowed on the free tier.

// plain text IPv4 — fastest option
fetch('https://ipv4.ippubblico.org/')
  .then(res => res.text())
  .then(ip => console.log(ip.trim())); // "203.0.113.42"

// IPv4 + IPv6 together
fetch('https://ippubblico.org/?text=1')
  .then(res => res.text())
  .then(text => {
    const lines = text.trim().split('\n');
    // "IPv4: 203.0.113.42"
    // "IPv6: NONE"
    console.log(lines[0]);
    console.log(lines[1]);
  });

// full geolocation
fetch('https://ippubblico.org/?api=1')
  .then(res => res.json())
  .then(data => {
    console.log(data.ip);              // "203.0.113.42"
    console.log(data.geo.country);     // "Italy"
    console.log(data.geo.city);        // "Milan"
    console.log(data.isp);             // "Telecom Italia"
    console.log(data.timezone);        // "Europe/Rome"
  });

import requests

# plain text
ip = requests.get('https://ipv4.ippubblico.org/').text.strip()
print(ip)  # 203.0.113.42

# full geolocation
data = requests.get('https://ippubblico.org/?api=1').json()
print(data['geo']['country'])   # Italy
print(data['geo']['city'])      # Milan
print(data['isp'])              # Telecom Italia
print(data['timezone'])         # Europe/Rome

# plain text
curl https://ipv4.ippubblico.org/
# 203.0.113.42

# full JSON
curl https://ippubblico.org/?api=1

Handling the rate limit on plain text endpoints:

async function getIP() {
  const res = await fetch('https://ipv4.ippubblico.org/');

  if (res.status === 429) {
    const wait = parseInt(res.headers.get('Retry-After') ?? '20', 10);
    await new Promise(resolve => setTimeout(resolve, wait * 1000));
    return getIP();
  }

  return res.text().then(t => t.trim());
}

Best for: frontend applications that need HTTPS and CORS, projects requiring both IP detection and geolocation in a single call, and use cases where commercial use on the free tier matters.

Which one to choose

Use ip-api.com if:

You are on the backend only (Node.js, Python, PHP server-side)
You need rich geolocation data
You will not use it commercially
You are comfortable with the HTTP-only limitation

Use ipify if:

You only need the IP address, no geolocation
You need maximum simplicity
You are writing shell scripts or CLI tools
You need very high volume without documented rate limits

Use IPPubblico if:

You are calling the API from the browser (requires HTTPS + CORS)
You need both IP detection and geolocation in one call
You need commercial use on the free tier
You want dedicated IPv4/IPv6 subdomains
You want a Retry-After header for clean error handling

Summary

None of these three services is universally better — they optimize for different constraints. ip-api.com has the richest data but breaks in browser environments on the free tier. ipify is the most reliable for the single job of IP detection but does nothing else. IPPubblico covers both cases with HTTPS and CORS included, at the cost of a rate limit on the plain text endpoints.

For most frontend projects in 2026, the HTTPS requirement alone rules out ip-api.com's free tier. Between ipify and IPPubblico, the choice comes down to whether you need geolocation or just the IP.

Full IPPubblico documentation: ippubblico.org/docs.html

How I detect user country in React without a backend call

Vix — Wed, 10 Jun 2026 06:48:44 +0000

How I detect user location in React without a backend call

Location detection is one of those features that sounds simple until you start implementing it. Most tutorials tell you to set up a backend, call a geolocation API server-side, pass the result to the frontend. That works, but it's overkill for many use cases.

This article shows how to detect the user's location directly from React — no backend, no key required, no setup — using IPPubblico.org. I'll cover hooks, class components, TypeScript, JavaScript, and real-world use cases like regional content and automatic redirects.

Language vs Location — IP geolocation tells you where the user is connecting from, not which language they prefer. For UI language, always use navigator.language or the browser's Accept-Language header — they reflect the user's actual preference. Use IP geolocation for location-dependent content: currency, shipping forms, regional pricing, legal disclaimers.

The endpoint

IPPubblico exposes a JSON endpoint that returns country, city, ISP, timezone and more:

GET https://ippubblico.org/?api=1

Sample response:

{
  "status": "ok",
  "ip": "203.0.113.42",
  "isp": "Example ISP",
  "timezone": "Europe/Rome",
  "geo": {
    "city": "Milan",
    "region": "Lombardy",
    "country": "Italy",
    "country_code": "IT",
    "lat": 45.4654,
    "lon": 9.1859
  }
}

No registration. No key. Works directly from the browser thanks to CORS support.

Use case 1 — Basic country detection with hooks (JavaScript)

The simplest implementation: fetch the country on component mount and store it in state.

import { useState, useEffect } from 'react';

function App() {
  const [country, setCountry] = useState(null);
  const [loading, setLoading] = useState(true);

  useEffect(() => {
    fetch('https://ippubblico.org/?api=1')
      .then(res => res.json())
      .then(data => {
        setCountry(data.geo?.country_code ?? null);
        setLoading(false);
      })
      .catch(() => {
        setLoading(false);
      });
  }, []);

  if (loading) return <p>Detecting location...</p>;

  return (
    <div>
      <p>Your country: {country ?? 'Unknown'}</p>
    </div>
  );
}

Use case 2 — Custom hook (JavaScript)

Reusable across the whole app. Put this in hooks/useIPInfo.js:

import { useState, useEffect } from 'react';

export function useIPInfo() {
  const [ipInfo, setIpInfo] = useState(null);
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState(null);

  useEffect(() => {
    let cancelled = false;

    fetch('https://ippubblico.org/?api=1')
      .then(res => {
        if (!res.ok) throw new Error(`HTTP ${res.status}`);
        return res.json();
      })
      .then(data => {
        if (!cancelled) {
          setIpInfo(data);
          setLoading(false);
        }
      })
      .catch(err => {
        if (!cancelled) {
          setError(err.message);
          setLoading(false);
        }
      });

    return () => { cancelled = true; };
  }, []);

  return { ipInfo, loading, error };
}

Usage anywhere in the app:

import { useIPInfo } from './hooks/useIPInfo';

function Header() {
  const { ipInfo, loading } = useIPInfo();

  if (loading) return null;

  return (
    <header>
      <p>Connecting from {ipInfo?.geo?.country ?? 'Unknown'}</p>
    </header>
  );
}

Use case 3 — Custom hook (TypeScript)

Same hook with full typing. Put this in hooks/useIPInfo.ts:

import { useState, useEffect } from 'react';

interface GeoInfo {
  city: string | null;
  region: string | null;
  country: string | null;
  country_code: string | null;
  lat: number | null;
  lon: number | null;
}

interface IPInfo {
  status: string;
  ip: string;
  ipv4: string | null;
  ipv6: string | null;
  isp: string | null;
  timezone: string | null;
  geo: GeoInfo;
}

interface UseIPInfoResult {
  ipInfo: IPInfo | null;
  loading: boolean;
  error: string | null;
}

export function useIPInfo(): UseIPInfoResult {
  const [ipInfo, setIpInfo] = useState<IPInfo | null>(null);
  const [loading, setLoading] = useState<boolean>(true);
  const [error, setError] = useState<string | null>(null);

  useEffect(() => {
    let cancelled = false;

    fetch('https://ippubblico.org/?api=1')
      .then(res => {
        if (!res.ok) throw new Error(`HTTP ${res.status}`);
        return res.json() as Promise<IPInfo>;
      })
      .then(data => {
        if (!cancelled) {
          setIpInfo(data);
          setLoading(false);
        }
      })
      .catch((err: Error) => {
        if (!cancelled) {
          setError(err.message);
          setLoading(false)
        }
      });

    return () => { cancelled = true; };
  }, []);

  return { ipInfo, loading, error };
}

Usage with full type safety:

import { useIPInfo } from './hooks/useIPInfo';

function LocationBadge() {
  const { ipInfo, loading, error } = useIPInfo();

  if (loading) return <span>...</span>;
  if (error) return null;

  return (
    <span>
      {ipInfo?.geo.country_code} — {ipInfo?.geo.city}
    </span>
  );
}

Use case 4 — With Axios (JavaScript)

If your project already uses Axios, the hook looks almost identical:

import { useState, useEffect } from 'react';
import axios from 'axios';

export function useIPInfoAxios() {
  const [ipInfo, setIpInfo] = useState(null);
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState(null);

  useEffect(() => {
    const source = axios.CancelToken.source();

    axios
      .get('https://ippubblico.org/?api=1', {
        cancelToken: source.token,
        timeout: 5000,
      })
      .then(res => {
        setIpInfo(res.data);
        setLoading(false);
      })
      .catch(err => {
        if (!axios.isCancel(err)) {
          setError(err.message);
          setLoading(false);
        }
      });

    return () => source.cancel();
  }, []);

  return { ipInfo, loading, error };
}

Use case 5 — Class component (JavaScript)

For legacy codebases that haven't migrated to hooks yet:

import React, { Component } from 'react';

class CountryDetector extends Component {
  constructor(props) {
    super(props);
    this.state = {
      countryCode: null,
      loading: true,
      error: null,
    };
  }

  componentDidMount() {
    fetch('https://ippubblico.org/?api=1')
      .then(res => {
        if (!res.ok) throw new Error(`HTTP ${res.status}`);
        return res.json();
      })
      .then(data => {
        this.setState({
          countryCode: data.geo?.country_code ?? null,
          loading: false,
        });
      })
      .catch(err => {
        this.setState({ error: err.message, loading: false });
      });
  }

  render() {
    const { countryCode, loading, error } = this.state;

    if (loading) return <p>Detecting location...</p>;
    if (error) return <p>Location unavailable</p>;

    return <p>Country: {countryCode ?? 'Unknown'}</p>;
  }
}

export default CountryDetector;

Use case 6 — Locale detection (language + location combined)

⚠️ Important distinction: use navigator.language for UI language — it reflects what the user configured in their browser. Use IP geolocation only for location-dependent defaults like currency or regional content. The example below shows both correctly combined.

import { useState, useEffect } from 'react';
import i18n from './i18n'; // your i18n setup

const COUNTRY_CURRENCY_MAP = {
  IT: 'EUR',
  DE: 'EUR',
  FR: 'EUR',
  GB: 'GBP',
  US: 'USD',
  JP: 'JPY',
  CN: 'CNY',
  BR: 'BRL',
};

function App() {
  const [ready, setReady] = useState(false);

  useEffect(() => {
    // Step 1: set UI language from browser preference
    const browserLang = navigator.language?.split('-')[0] ?? 'en';
    i18n.changeLanguage(browserLang);

    // Step 2: set location-dependent defaults from IP
    fetch('https://ippubblico.org/?api=1')
      .then(res => res.json())
      .then(data => {
        const code = data.geo?.country_code;
        const currency = COUNTRY_CURRENCY_MAP[code] ?? 'USD';
        // use currency for pricing, shipping, etc. — not for language
        console.log('User currency:', currency);
      })
      .catch(() => {})
      .finally(() => setReady(true));
  }, []);

  if (!ready) return <div>Loading...</div>;

  return <MainApp />;
}

Use case 7 — Automatic redirect by country

Redirect users to the correct regional URL based on their location:

import { useEffect } from 'react';
import { useNavigate } from 'react-router-dom';

const COUNTRY_ROUTES = {
  IT: '/it',
  DE: '/de',
  FR: '/fr',
  ES: '/es',
};

function CountryRedirect() {
  const navigate = useNavigate();

  useEffect(() => {
    // only redirect on first visit
    const redirected = sessionStorage.getItem('country_redirected');
    if (redirected) return;

    fetch('https://ippubblico.org/?api=1')
      .then(res => res.json())
      .then(data => {
        const code = data.geo?.country_code;
        const route = COUNTRY_ROUTES[code];
        if (route) {
          sessionStorage.setItem('country_redirected', '1');
          navigate(route, { replace: true });
        }
      })
      .catch(() => {
        // no redirect on error — stay on default
      });
  }, [navigate]);

  return null;
}

export default CountryRedirect;

Add it once at the top of your router:

function App() {
  return (
    <BrowserRouter>
      <CountryRedirect />
      <Routes>
        <Route path="/" element={<Home />} />
        <Route path="/it" element={<HomeIT />} />
        <Route path="/de" element={<HomeDE />} />
        <Route path="/fr" element={<HomeFR />} />
      </Routes>
    </BrowserRouter>
  );
}

Caching the result

Location rarely changes between page loads. Cache the result in sessionStorage to avoid repeated API calls:

const CACHE_KEY = 'ippubblico_ipinfo';

async function getIPInfoCached() {
  const cached = sessionStorage.getItem(CACHE_KEY);
  if (cached) {
    try {
      return JSON.parse(cached);
    } catch (_) {}
  }

  const res = await fetch('https://ippubblico.org/?api=1');
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  const data = await res.json();

  sessionStorage.setItem(CACHE_KEY, JSON.stringify(data));
  return data;
}

Handling rate limits

If you call the API too frequently from the same IP, you will receive a 429 Too Many Requests response with a Retry-After header. A simple retry handler:

async function fetchWithRetry(url, retries = 1) {
  const res = await fetch(url);

  if (res.status === 429 && retries > 0) {
    const retryAfter = parseInt(res.headers.get('Retry-After') ?? '20', 10);
    await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
    return fetchWithRetry(url, retries - 1);
  }

  return res;
}

// usage
const res = await fetchWithRetry('https://ippubblico.org/?api=1');
const data = await res.json();

In practice, if you cache the result in sessionStorage you will almost never hit the limit.

Quick reference

Need	Endpoint	Response
IPv4 only	`https://ipv4.ippubblico.org/`	`203.0.113.42`
IPv6 only	`https://ipv6.ippubblico.org/`	`2001:db8::1` or `NONE`
Both protocols	`https://ippubblico.org/?text=1`	`IPv4: x\nIPv6: x`
Full geolocation	`https://ippubblico.org/?api=1`	JSON with country, city, ISP

Full API documentation: ippubblico.org/docs.html

Conclusion

Detecting the user's location from React without a backend is straightforward with the right API. IPPubblico gives you everything from a plain IP address to full geolocation in a single call, with no key, no billing, and no setup.

The key takeaway: use navigator.language for language, use IP geolocation for location. They solve different problems and work best together.

Using a different approach for location detection in React? Share it in the comments.

Getting the public IP in Flutter — no API key, no rate limits, no hassle

Vix — Tue, 09 Jun 2026 08:46:13 +0000

Getting the public IP in Flutter — no API key, no rate limits, no hassle

If you've ever built a Flutter app that needs to know the user's public IP address, you've probably gone through the same journey I did: pick a free service, add the key, hit the rate limit, look for another one, repeat.

This article shows a cleaner approach using IPPubblico.org — a completely free API with no key required, HTTPS, CORS enabled, and no rate limits for reasonable usage. I'll cover four common use cases with real code, from the simplest one-liner to full geolocation with country detection.

Why IPPubblico?

Before diving into code, here's why it's worth trying:

No API key — zero setup, works immediately
HTTPS only — no mixed content issues
CORS enabled — works from web too
Plain text endpoint — no JSON parsing for simple cases
Full JSON endpoint — city, region, country, ISP, ASN, timezone when you need it
Free for reasonable usage — no hidden quotas

Setup

Add http to your pubspec.yaml:

dependencies:
  flutter:
    sdk: flutter
  http: ^1.2.0

And add internet permission to AndroidManifest.xml:

<uses-permission android:name="android.permission.INTERNET" />

Use case 1 — Just the IP (simplest possible)

If you only need the raw IPv4 address, use the plain text endpoint:

import 'package:http/http.dart' as http;

Future<String?> getPublicIP() async {
  try {
    final response = await http
        .get(Uri.parse('https://ipv4.ippubblico.org/'))
        .timeout(const Duration(seconds: 5));

    if (response.statusCode == 200) {
      return response.body.trim();
    }
  } catch (e) {
    debugPrint('Failed to get IP: $e');
  }
  return null;
}

Usage:

final ip = await getPublicIP();
print(ip); // 203.0.113.42

That's it. No parsing, no model classes, no authentication. The endpoint returns a single line with the IP address.

Use case 2 — IPv4 and IPv6 together

If you need to detect both protocols, use the ?text=1 endpoint on the main domain:

Future<Map<String, String?>> getBothIPs() async {
  try {
    final response = await http
        .get(Uri.parse('https://ippubblico.org/?text=1'))
        .timeout(const Duration(seconds: 5));

    if (response.statusCode == 200) {
      final lines = response.body.trim().split('\n');
      String? ipv4;
      String? ipv6;

      for (final line in lines) {
        if (line.startsWith('IPv4: ')) {
          final value = line.substring(6).trim();
          if (value != 'NONE') ipv4 = value;
        } else if (line.startsWith('IPv6: ')) {
          final value = line.substring(6).trim();
          if (value != 'NONE') ipv6 = value;
        }
      }

      return {'ipv4': ipv4, 'ipv6': ipv6};
    }
  } catch (e) {
    debugPrint('Failed to get IPs: $e');
  }
  return {'ipv4': null, 'ipv6': null};
}

Usage:

final ips = await getBothIPs();
print('IPv4: ${ips['ipv4']}'); // IPv4: 203.0.113.42
print('IPv6: ${ips['ipv6']}'); // IPv6: 2001:db8::1 or null

Use case 3 — Full geolocation data

When you need country, city, ISP and timezone, use the JSON endpoint:

import 'dart:convert';
import 'package:http/http.dart' as http;

class IPInfo {
  final String ip;
  final String? country;
  final String? countryCode;
  final String? city;
  final String? region;
  final String? isp;
  final String? timezone;
  final double? lat;
  final double? lon;

  IPInfo({
    required this.ip,
    this.country,
    this.countryCode,
    this.city,
    this.region,
    this.isp,
    this.timezone,
    this.lat,
    this.lon,
  });

  factory IPInfo.fromJson(Map<String, dynamic> json) {
    final geo = json['geo'] as Map<String, dynamic>? ?? {};
    return IPInfo(
      ip: json['ip'] ?? '',
      country: geo['country'],
      countryCode: geo['country_code'],
      city: geo['city'],
      region: geo['region'],
      isp: json['isp'],
      timezone: json['timezone'],
      lat: (geo['lat'] as num?)?.toDouble(),
      lon: (geo['lon'] as num?)?.toDouble(),
    );
  }
}

Future<IPInfo?> getIPInfo() async {
  try {
    final response = await http
        .get(Uri.parse('https://ippubblico.org/?api=1'))
        .timeout(const Duration(seconds: 5));

    if (response.statusCode == 200) {
      final json = jsonDecode(response.body) as Map<String, dynamic>;
      return IPInfo.fromJson(json);
    }
  } catch (e) {
    debugPrint('Failed to get IP info: $e');
  }
  return null;
}

Usage:

final info = await getIPInfo();
if (info != null) {
  print('IP: ${info.ip}');
  print('Country: ${info.country} (${info.countryCode})');
  print('City: ${info.city}, ${info.region}');
  print('ISP: ${info.isp}');
  print('Timezone: ${info.timezone}');
}

Sample response:

{
  "status": "ok",
  "ip": "203.0.113.42",
  "isp": "Example ISP",
  "timezone": "Europe/Rome",
  "geo": {
    "city": "Milan",
    "region": "Lombardy",
    "country": "Italy",
    "country_code": "IT",
    "lat": 45.4654,
    "lon": 9.1859
  }
}

Use case 4 — Country detection for locale/content

A common real-world need: detect the user's country on first launch to set the default language or show region-specific content.

class CountryDetector {
  static String? _cachedCountryCode;

  static Future<String?> getCountryCode() async {
    if (_cachedCountryCode != null) return _cachedCountryCode;

    try {
      final response = await http
          .get(Uri.parse('https://ippubblico.org/?api=1'))
          .timeout(const Duration(seconds: 5));

      if (response.statusCode == 200) {
        final json = jsonDecode(response.body) as Map<String, dynamic>;
        final geo = json['geo'] as Map<String, dynamic>? ?? {};
        _cachedCountryCode = geo['country_code'] as String?;
        return _cachedCountryCode;
      }
    } catch (e) {
      debugPrint('Country detection failed: $e');
    }
    return null;
  }

  static void clearCache() {
    _cachedCountryCode = null;
  }
}

Usage in main.dart:

void main() async {
  WidgetsFlutterBinding.ensureInitialized();

  final countryCode = await CountryDetector.getCountryCode();
  final locale = _localeFromCountry(countryCode);

  runApp(MyApp(initialLocale: locale));
}

Locale _localeFromCountry(String? code) {
  switch (code) {
    case 'IT': return const Locale('it');
    case 'DE': return const Locale('de');
    case 'FR': return const Locale('fr');
    case 'CN': return const Locale('zh');
    case 'JP': return const Locale('ja');
    default:   return const Locale('en');
  }
}

Handling errors gracefully

A real app should always have a fallback. Here's a production-ready wrapper that tries multiple strategies:

Future<String?> getPublicIPWithFallback() async {
  // try plain text endpoint first (fastest)
  try {
    final response = await http
        .get(Uri.parse('https://ipv4.ippubblico.org/'))
        .timeout(const Duration(seconds: 3));
    if (response.statusCode == 200) {
      return response.body.trim();
    }
  } catch (_) {}

  // fallback to JSON endpoint
  try {
    final response = await http
        .get(Uri.parse('https://ippubblico.org/?api=1'))
        .timeout(const Duration(seconds: 5));
    if (response.statusCode == 200) {
      final json = jsonDecode(response.body) as Map<String, dynamic>;
      return json['ip'] as String?;
    }
  } catch (_) {}

  return null;
}

Respecting rate limits

IPPubblico is free and has no hard quotas, but like any public API it has soft rate limiting to prevent abuse. A few guidelines:

Don't poll continuously — check the IP once at app startup and cache it
Cache the result — an IP address rarely changes; re-check at most every few minutes if you really need it live
Handle 429 — if you get a Too Many Requests response, read the Retry-After header and wait before retrying:

Future<String?> getIPRespectingRateLimit() async {
  final response = await http
      .get(Uri.parse('https://ipv4.ippubblico.org/'))
      .timeout(const Duration(seconds: 5));

  if (response.statusCode == 200) {
    return response.body.trim();
  }

  if (response.statusCode == 429) {
    final retryAfter = int.tryParse(
      response.headers['retry-after'] ?? '20'
    ) ?? 20;
    debugPrint('Rate limited. Retry after $retryAfter seconds.');
    await Future.delayed(Duration(seconds: retryAfter));
    // retry once
    final retry = await http
        .get(Uri.parse('https://ipv4.ippubblico.org/'))
        .timeout(const Duration(seconds: 5));
    if (retry.statusCode == 200) return retry.body.trim();
  }

  return null;
}

Quick reference

Need	Endpoint	Response
IPv4 only	`https://ipv4.ippubblico.org/`	`203.0.113.42`
IPv6 only	`https://ipv6.ippubblico.org/`	`2001:db8::1` or `NONE`
Both protocols	`https://ippubblico.org/?text=1`	`IPv4: x.x.x.x\nIPv6: x`
Full geolocation	`https://ippubblico.org/?api=1`	JSON with city, country, ISP

Full API documentation: ippubblico.org/docs.html

Conclusion

IPPubblico covers everything from the simplest "just give me the IP" to full geolocation with a single API, no registration, no key management, no billing surprises. For Flutter apps that just need to know where their users are connecting from, it's the path of least resistance.

The Retry-After header handling is worth implementing even if you never hit the limit — it's good practice and makes your app resilient by design.

Have you used a different approach for IP detection in Flutter? Share it in the comments.

I switched from ip-api.com to a zero-key API — here's why (HTTPS, CORS, no rate limits)

Vix — Wed, 03 Jun 2026 12:28:55 +0000

f you've ever tried to use ip-api.com on an HTTPS site, you've hit this error:
"Mixed Content: The page was loaded over 'https', but requested an insecure resource 'http://ip-api.com/json'. This request has been blocked."
ip-api.com is the most cited free geolocation API on the internet — Stack Overflow answers, tutorials, GitHub gists. It's genuinely good. But its free tier only supports HTTP, which means it silently breaks on any HTTPS page. Browsers block it. No fallback, no warning in your code — it just fails.
I ran into this while building a feature that needed to show region-specific content. Here's what I found after testing several alternatives.

The problem in one line:

// This breaks silently on any HTTPS site
fetch('http://ip-api.com/json')  // ❌ blocked by browser mixed-content policy

What I needed

HTTPS endpoint (non-negotiable in 2026)
No API key or signup
CORS enabled (works directly from the browser)
Returns country, city, ISP — not just the raw IP
No commercial use restrictions

The solution I'm using:

// Works on HTTPS, no key, CORS enabled
fetch('https://ippubblico.org/?api=1')
  .then(res => res.json())
  .then(data => {
    console.log(data.ip);          // "93.56.x.x"
    console.log(data.country);     // "Italy"
    console.log(data.countryCode); // "IT"
    console.log(data.city);        // "Rome"
    console.log(data.isp);         // "Telecom Italia"
    console.log(data.timezone);    // "Europe/Rome"
    console.log(data.lat);         // 41.9028
    console.log(data.lon);         // 12.4964
  });

Full response schema:
{
  "ip": "93.56.x.x",
  "country": "Italy",
  "countryCode": "IT",
  "region": "Lazio",
  "city": "Rome",
  "zip": "00100",
  "lat": 41.9028,
  "lon": 12.4964,
  "timezone": "Europe/Rome",
  "isp": "Telecom Italia",
  "asn": "AS3269"
}

Production-ready snippet with caching
Avoid calling the API on every page load — cache in sessionStorage:

async function getClientGeo() {
  const cached = sessionStorage.getItem('_geo');
  if (cached) return JSON.parse(cached);

  try {
    const res = await fetch('https://ippubblico.org/?api=1');
    const data = await res.json();
    sessionStorage.setItem('_geo', JSON.stringify(data));
    return data;
  } catch (e) {
    return null;
  }
}

// Usage
const geo = await getClientGeo();
if (geo?.countryCode === 'US') {
  // show USD pricing
}

Python (server-side)

pythonimport requests

data = requests.get('https://ippubblico.org/?api=1').json()
print(data['country'])   # Italy
print(data['isp'])       # Telecom Italia

Bash / curl

bash# Plain IP
curl -s https://ippubblico.org/?text=1

# Full JSON
curl -s https://ippubblico.org/?api=1

# Extract country with jq
curl -s https://ippubblico.org/?api=1 | jq -r '.country'

Quick comparison

ip-api.com — free but HTTP only, no key required, non-commercial use only
ipify.org — HTTPS, no key, returns IP address only (no geolocation)
ipinfo.io — HTTPS, key required, limited free tier
ipstack.com — HTTPS only on paid tier, key required
ippubblico.org — HTTPS, no key, no restrictions, full geolocation

Multilingual responses
One thing I didn't expect: the API supports 43 languages via the lang parameter.

javascriptfetch('https://ippubblico.org/?api=1&lang=it')
  .then(res => res.json())
  .then(data => console.log(data.country)); // "Italia"

Useful if you're building multilingual apps and want country names in the user's language without a translation layer.

API docs
Full documentation at https://ippubblico.org/docs.html — includes examples for curl, JavaScript, Python, PHP, and Dart.