ipify Authentication: API Key Setup and Security (2026)

Authentication overview

ipify provides a straightforward API for retrieving public IP addresses (IPv4 and IPv6) and associated geolocation data. Access to the ipify API is controlled through API key authentication. This mechanism requires developers to include a unique, secret key with each API request. The API key serves as the primary identifier for your account, enabling ipify to track usage, apply rate limits, and ensure that only authorized applications consume the service. All API interactions should occur over HTTPS to protect the API key and data in transit, preventing eavesdropping and tampering of the request URL and its parameters.

The API key is typically generated through the ipify account dashboard after registration. This approach aligns with common practices for many web APIs, where a simple token or key grant access to specific resources or functionalities. For example, similar API key models are used by services like Stripe for payment processing or Twilio for communication services, where the key identifies the calling application or user account for billing and access control purposes. Understanding the implications of API key exposure is crucial for maintaining the security of an application that integrates with ipify.

Supported authentication methods

ipify primarily supports a single authentication method for its API:

• API Key Authentication: This is the standard and only method for authenticating requests to the ipify API. An API key is a unique string that identifies your application or user account.

The API key is passed as a query parameter named apiKey in the request URL. This method is suitable for applications where the API key can be securely stored and transmitted, such as server-side applications. While convenient, passing keys in query parameters requires careful attention to security, especially when dealing with client-side applications or logs, as URLs can sometimes be logged or exposed more readily than request headers or bodies.

The following table summarizes the authentication method:

It is important to note that ipify does not support more complex authentication flows like OAuth 2.0 or mutual TLS (mTLS), which are often found in APIs requiring delegated authorization or enhanced client authentication, such as those in the financial or healthcare sectors. For example, OAuth 2.0 is a common framework for delegated authorization in APIs like Google's developer services, allowing users to grant third-party applications limited access to their resources without sharing credentials. The simplicity of ipify's API key model reflects its primary use case as a direct, unmediated IP lookup service.

Getting your credentials

To obtain your ipify API key, follow these steps:

1. Sign Up/Log In: Navigate to the ipify homepage and either sign up for a new account or log in to an existing one. Account creation typically involves providing an email address and setting a password.
2. Access Dashboard: After successful login, you will be directed to your account dashboard. This dashboard is the central place for managing your subscription, viewing usage statistics, and accessing your API key.
3. Locate API Key: Your unique API key will be displayed prominently within the dashboard, often under a section like "API Key" or "Credentials." The ipify documentation provides specific instructions on where to find this key within the user interface.
4. Copy and Secure: Copy your API key. Treat this key as a sensitive secret, similar to a password. Do not hardcode it directly into client-side code, commit it to public version control systems, or expose it in publicly accessible logs. For server-side applications, store it in environment variables or a secure configuration management system.

ipify offers a free tier that includes 10,000 requests per month, and an API key is required even for this free usage. Paid plans are available for higher request volumes. The same API key is used across all tiers, with access limits adjusted based on your subscription level.

Authenticated request example

Once you have your API key, you can make authenticated requests to the ipify API. The API key is included as a query parameter in the request URL.

IPv4 Address Lookup

To retrieve your public IPv4 address, you would make a request similar to this:

curl "https://api.ipify.org?format=json&apiKey=YOUR_API_KEY"

Replace YOUR_API_KEY with the actual API key obtained from your ipify dashboard.

Expected JSON response:

{
  "ip": "192.0.2.1"
}

IPv6 Address Lookup

For an IPv6 address, the endpoint is slightly different:

curl "https://api6.ipify.org?format=json&apiKey=YOUR_API_KEY"

Expected JSON response:

{
  "ip": "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
}

Geolocation Data

If your ipify plan includes geolocation data, you can request it by adding the geo=true parameter:

curl "https://api.ipify.org?format=json&apiKey=YOUR_API_KEY&geo=true"

Expected JSON response (example):

{
  "ip": "192.0.2.1",
  "location": {
    "country": "United States",
    "region": "California",
    "city": "San Francisco",
    "latitude": 37.7749,
    "longitude": -122.4194,
    "postalCode": "94103",
    "timezone": "America/Los_Angeles",
    "asn": "ASXXXXX",
    "organization": "Example ISP"
  }
}

These examples demonstrate how the apiKey parameter integrates directly into the URL structure. Always ensure your requests are made over HTTPS to protect the key during transmission.

Security best practices

Securing your ipify API key is critical to prevent unauthorized usage and potential service disruptions. Adhere to these best practices:

• Use HTTPS Always: Ensure all requests to the ipify API are made over HTTPS (TLS/SSL). This encrypts the communication channel, protecting your API key from interception during transit. Without HTTPS, an attacker could potentially eavesdrop on your network traffic and steal your API key. The Mozilla Developer Network provides an overview of TLS.
• Server-Side Usage: Whenever possible, use ipify API keys exclusively from your server-side applications. This keeps the key out of client-side code (e.g., JavaScript in a web browser or mobile app) where it could be easily exposed to end-users or malicious actors.
• Environment Variables: Store API keys in environment variables rather than hardcoding them directly into your application's source code. This practice separates sensitive credentials from your codebase, making it easier to manage and preventing accidental exposure in version control systems. For cloud deployments, leverage secret management services like AWS Secrets Manager or Google Secret Manager.
• Do Not Commit Keys: Never commit your API key directly into your source code repository, especially if it's publicly accessible. Use .gitignore or similar mechanisms to exclude files containing credentials from version control.
• Restrict Referrers/IPs (if available): While ipify's dashboard does not currently offer referrer or IP restrictions for API keys, it's a general best practice for APIs that do support it. For other APIs, restricting API key usage to specific IP addresses or HTTP referrers adds an extra layer of security, limiting where the key can be used even if it is compromised.
• Monitor Usage: Regularly check your ipify account dashboard for unusual API usage patterns. Spikes in requests or usage from unexpected regions could indicate a compromised key.
• Key Rotation: Periodically rotate your API keys. If ipify provides a mechanism to generate new keys and revoke old ones, use it as a routine security measure. Regular rotation minimizes the window of opportunity for a compromised key to be exploited.
• Error Handling: Implement robust error handling in your application. If an API request fails due to an authentication error, log the event securely and alert administrators without exposing sensitive information to end-users.

Adhering to these practices helps maintain the confidentiality and integrity of your ipify API key, reducing the risk of unauthorized access and ensuring the smooth operation of your applications.