Read-only API

This API is not public. Sign in with Google and this page hands you the token to call it with — no key to paste, no account to create here, and no session on our side. The token is a JWT that Google signs over your account; we verify it on every request and it never leaves your browser except to call this API.

Signing in happens between your browser and Google. We never see your password, and the only thing we do with the token is check its signature when you call the API.

Signed in as …. Token valid until ….

Treat the token like a password for the next hour — it identifies your account to this API. Nothing here stores it: close the tab and it is gone.

Try it

Signed in. Press the button and the answer appears here.

The call

GET https://ipmap.info/api/v1/8.8.8.8
Authorization: Bearer <the token from above>

Response

{
  "ok": true,
  "ip": "8.8.8.8",
  "address_family": "IPv4",
  "country": "United States",
  "country_code": "US",
  "region": "California",
  "city": "Mountain View",
  "postal_code": "94043",
  "continent": "North America",
  "latitude": 37.4056,
  "longitude": -122.0775,
  "asn": "AS15169 — 8.8.8.0/24",
  "organisation": "Google LLC",
  "reverse_dns": "dns.google"
}

asn, organisation and reverse_dns are null until that address has been looked up on the site at least once.
Responses are cached for 5 minutes and rate limited per client — 60 per minute. CORS is reflected for our own origin only; a browser on somebody else's page cannot read your answer.
Geolocation is the free DB-IP city database (CC BY 4.0). Please keep the attribution when you display it.
Machine-readable summary: /llms.txt.

Who may call it

Only accounts we have allowed: this is an allowlist, not a public service. If the try-it box answers 401, the account you signed in with is not on it yet — tell us which address you used and we will add it. A token is also refused if it was not signed for this site's client id, has expired, or carries an unverified address.

From a server, without a browser

A cron job has no browser to sign in with, so it mints the same kind of token from a service account and sends it the same way:

ID_TOKEN=$(gcloud auth print-identity-token --audiences=<client id>)
curl -s -H "Authorization: Bearer $ID_TOKEN" https://ipmap.info/api/v1/8.8.8.8

Any equivalent will do, as long as it produces an ID token whose aud is our client id: an OAuth device or authorization-code flow with the openid scope, a service account with the token-creator role, or a browser like the one above.

The game behind this: Subnet Sweeper — work the mask out

More tools: all network tools · DNS records · HTTP headers · TLS certificate · API · badge · ad & analytics checker · traceroute globe.