The VPN and proxy detection API
A single GET returns every anonymity flag we hold for an address, each one carrying the provider behind it and how strongly it is supported. One POST answers up to 1,000 at once.
Try it on an address
Pick an address and read the response. You don't need an SDK or a key.
Errors and limits
A limit hit, a revoked key and an address we have nothing on answer the same way every time, with a status code your code can branch on.
HTTP/1.1 429 Too Many RequestsRetry-After: 1{"error": "rate limit exceeded"}
The header tells the two 429s apart. Present means a transient rate limit and retrying works; absent means an allowance is spent and retrying will not help.
Retry with backoff and jitter. The next attempt lands on a healthy edge. Every official client does this for you.
The SDKs never send them. Private, loopback, link-local, documentation and multicast ranges, including 6to4 and Teredo, answer with every flag false. Sent to the API directly, they count against a keyless or Free plan allowance and cost nothing on a paid plan.
Common questions
Which fields come back?
ip and is_vpn without a key. A free key adds Tor, relay, location and asn, and every paid plan answers every field, the same on each, as the pricing page lays out. A flag your plan includes is always in the response, true or false, and its detail object is {} when the flag is false. A field your plan doesn't include is left out, so a missing key means not in your plan, never no.
How do I send my API key?
In an Authorization: Bearer header, an X-Api-Key header or an apikey query parameter, whichever your client makes easiest. A key can be limited to the addresses your servers call from, and a call from anywhere else answers 403.
Is there a rate limit?
Without a key, 1,000 lookups a day from each address. With one, your plan's monthly quota is the limit that matters, and there's no published per-second ceiling: a 429 that carries Retry-After is a brief throttle to wait out, and one without it means the quota is spent.
Can I call it from a browser?
Yes, from any origin. A key in a page is readable by anyone who loads it, so make the calls you act on from your server. Without a key, GET /myip from the visitor's browser answers ip and is_vpn for their own address, within that address's daily allowance.
Should I cache answers?
The official clients already do: each keeps up to 10,000 answers for an hour by default, and both numbers can be changed or the cache turned off. A cached answer costs no request, and errors are never cached.
Do you support IPv6?
Yes, on the same endpoint as IPv4, and every dataset holds IPv6 addresses. An IPv4-mapped address (::ffff:a.b.c.d) is answered as the IPv4 address it carries.
Is there an SLA?
Enterprise contracts carry agreed response times and a named contact. Live availability is on the status page, and the official clients retry a 5xx for you.
Start without signing up.
Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.
{"ip": "146.70.116.130","is_vpn": true}