Common tasks
Short examples for the things people use the API for most.
Each example reads real fields from the response. Swap in your own thresholds.
Decide at sign-up or checkout
scoring.recommended_action turns the 0 to 100 score into one of four actions: allow (0 to 25), review (26 to 50), step_up (51 to 75) and block (76 to 100).
const res = await fetch(`https://api.geoiphub.com/v1/lookup/${ip}`, {
headers: { "x-api-key": process.env.GEOIPHUB_API_KEY },
});
const data = await res.json();
switch (data.scoring.recommended_action) {
case "allow":
return accept();
case "review":
case "step_up":
return askForVerification(); // email code, 2FA or a card check
case "block":
return reject();
}scoring.detection_methods lists the signals behind the score, so you can log why a decision was made.
Spot VPNs, proxies and Tor
const d = data.detection;
const anonymized = d.is_vpn || d.is_proxy || d.is_tor;
const relay = d.is_relay; // iCloud Private Relay and similar: real people, usually fineis_relay is reported separately from VPNs on purpose. Privacy relays are used by ordinary customers, so most sites shouldn't block them.
Verify a crawler
A request that says it's Googlebot or GPTBot can be checked against the operator's published IP ranges:
const crawler = data.threat.crawler;
if (crawler.verified) {
console.log(crawler.name, crawler.operator, crawler.category);
}crawler.verified is true only when the address is inside that operator's official ranges. Compare crawler.name with the bot your request claims to be.
Show content by country
const country = data.geo.country_code; // "US", "DE", ...
const inEU = data.geo.is_in_european_union;Handle missing values
Fields with no value are "none", not null:
const value = (v) => (v === "none" ? null : v);
const city = value(data.geo.city);