IP2Location Authentication: API Key Setup & Security (2026)

Authentication overview

IP2Location provides two distinct products: a Web Service API for real-time lookups and downloadable databases for local integration. Each product employs a specific authentication mechanism tailored to its deployment model.

• Web Service Authentication: Access to the IP2Location Web Service is controlled via a unique API key. This key identifies the user account and ensures that API requests are authorized and usage quotas are tracked correctly. The API key is typically passed as a query parameter in HTTP GET requests.
• Database Authentication: For downloadable databases, a license key is used. This key is provided upon purchase or subscription and is required to unlock and utilize the database files. Unlike the Web Service API key, the database license key is typically used once for activation or verification within the application that accesses the database, rather than with every data lookup.

Understanding the distinction between these authentication methods is essential for integrating IP2Location services effectively. Detailed documentation for the Web Service, including authentication parameters, is available on the IP2Location Web Service documentation page. For database integration, users should refer to the specific integration guides provided with their database purchase.

Supported authentication methods

IP2Location's primary authentication method for its Web Service is the API key. This approach is common for many RESTful APIs due to its simplicity and ease of implementation. The API key serves as a token that authenticates the client application making the request to the IP2Location server.

API keys are typically passed directly in the URL query string. While this method is straightforward, it necessitates strict adherence to HTTPS for all communications to prevent the key from being intercepted in transit. The IP2Location API reference specifies how API keys should be included in requests.

For downloadable databases, the license key is embedded or configured within the application that reads the database. This approach means that authentication occurs client-side, typically during application startup or database initialization, rather than with every lookup request over the network.

Getting your credentials

To obtain the necessary credentials for IP2Location services, follow these steps:

1. Sign Up for an IP2Location Account: If you don't already have one, create an account on the IP2Location website.
2. Access Your Dashboard: Log in to your IP2Location account. The dashboard serves as your central point for managing services, subscriptions, and credentials.
3. Locate Your API Key (for Web Service): For Web Service access, your API key will be displayed prominently within your account dashboard, often under a section like "API Key" or "Web Service." You may need to generate a new key if it's your first time accessing the service. The IP2Location developer resources provide guidance on locating and managing your key.
4. Retrieve Your License Key (for Databases): If you have purchased an IP2Location database, your license key will be available in your account's download or subscription management section. This key is typically provided alongside instructions for downloading and using the database files.

It is important to treat both your API key and license key as sensitive information. Do not embed them directly in client-side code that can be easily inspected, and ensure they are stored securely. For Web Service API keys, consider using environment variables or a secrets management service.

Some services, like Google Cloud's API Key documentation, advise restricting API keys to specific IP addresses or HTTP referrers to enhance security, a practice that can be applied where supported by the API provider.

Authenticated request example

IP2Location's Web Service API uses a simple query parameter for API key authentication. The following examples demonstrate how to make an authenticated request using common programming languages. Replace YOUR_API_KEY with your actual IP2Location API key and 1.2.3.4 with the IP address you wish to query.

Python Example

import requests

api_key = "YOUR_API_KEY"
ip_address = "8.8.8.8"  # Example IP address

url = f"https://api.ip2location.com/v2/?key={api_key}&ip={ip_address}&package=WS25&addon=continent,country,region,city,zipcode,latitude,longitude,isp,domain,usagetype,asn,as&format=json"

try:
    response = requests.get(url)
    response.raise_for_status()  # Raise an exception for HTTP errors
    data = response.json()
    print(data)
except requests.exceptions.RequestException as e:
    print(f"Request failed: {e}")

Node.js Example

const fetch = require('node-fetch');

const apiKey = "YOUR_API_KEY";
const ipAddress = "8.8.8.8"; // Example IP address

const url = `https://api.ip2location.com/v2/?key=${apiKey}&ip=${ipAddress}&package=WS25&addon=continent,country,region,city,zipcode,latitude,longitude,isp,domain,usagetype,asn,as&format=json`;

async function getGeolocation() {
  try {
    const response = await fetch(url);
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log(data);
  } catch (error) {
    console.error("Geolocation request failed:", error);
  }
}

getGeolocation();

PHP Example

<?php

$apiKey = "YOUR_API_KEY";
$ipAddress = "8.8.8.8"; // Example IP address

$url = "https://api.ip2location.com/v2/?key={$apiKey}&ip={$ipAddress}&package=WS25&addon=continent,country,region,city,zipcode,latitude,longitude,isp,domain,usagetype,asn,as&format=json";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);

if (curl_errno($ch)) {
    echo 'Curl error: ' . curl_error($ch);
} else {
    $data = json_decode($response, true);
    print_r($data);
}

curl_close($ch);

?>

These examples demonstrate the fundamental structure for authenticating requests. The key query parameter is consistently used to pass the API key. For more complex queries or additional parameters, refer to the IP2Location Web Service API documentation.

Security best practices

Properly securing your IP2Location credentials is vital to prevent unauthorized access to your account and services. Adhere to these best practices:

• Use HTTPS for all Web Service API Calls: Always ensure that your API requests to the IP2Location Web Service are made over HTTPS. This encrypts the communication channel, protecting your API key from interception during transmission.
• Protect Your API Key:
• Avoid Hardcoding: Do not hardcode API keys directly into your application's source code, especially for client-side applications where the code can be easily inspected.
• Environment Variables: For server-side applications, store API keys as environment variables. This keeps them out of your version control system and makes them easier to manage across different deployment environments.
• Secrets Management: For more robust solutions, use a dedicated secrets management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). These services provide secure storage and retrieval of sensitive credentials.
• Server-Side Proxy: If you must make requests from a client-side application, consider routing them through a server-side proxy. The proxy can securely store your API key and append it to requests before forwarding them to IP2Location, preventing the key from being exposed in the client's browser or mobile app.
• Restrict API Key Usage (if applicable): While IP2Location's Web Service does not currently offer IP address or referrer restrictions for API keys directly, it is a recommended general security practice where supported by API providers to limit the key's scope. For services that do, this means configuring the API key to only accept requests from specific IP addresses or domains.
• Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This minimizes the impact of a compromised key, as the exposure window is reduced.
• Monitor Usage: Regularly check your IP2Location account dashboard for unusual activity or spikes in usage that could indicate a compromised API key.
• Secure Database Files and License Keys: For downloadable databases, ensure that the database files themselves are stored on secure servers with appropriate access controls. The license key used to activate or verify the database should also be protected and not publicly exposed.
• Least Privilege Principle: Grant only the necessary permissions to the systems or users that require access to your IP2Location credentials.

Following these practices helps maintain the confidentiality and integrity of your geolocation data and services.