ip-api.com alternatives: HTTPS, commercial use, and the ip-api vs ipapi name confusion

ip-api.com is often the first IP geolocation API a developer tries: no sign-up, no key, a clean JSON response. Then one of three things happens. The site moves to HTTPS and browser calls to http://ip-api.com are blocked as mixed content. The project becomes commercial, which the free endpoint doesn't allow. Or traffic passes 45 requests a minute and requests start failing with 429.

This guide covers what ip-api.com allows on its free and paid plans, when its Pro plan is the right answer (often), what the alternatives offer, and how to migrate. It also untangles a real source of confusion: at least five different services are called something like "ipapi". All facts were checked on the providers' official pages on 12 November 2026.

What ip-api.com's free endpoint allows

From the ip-api.com JSON documentation and batch documentation:

The HTTP-only rule is the one that usually forces a change. Browsers block plain HTTP requests from HTTPS pages, so the free endpoint only works from a server, and there the per-IP rate limit applies to all your traffic.

ip-api.com Pro: maybe all you need

Before you switch, look at ip-api Pro. As listed on 12 November 2026:

• 13,30 € per month when paying for 12 months, prices in euro excluding VAT. 3- and 6-month terms are also offered.
• Unlimited requests, subject to the acceptable use policy.
• HTTPS, commercial use, API keys (up to 10) with IP or Origin restrictions, usage statistics.
• 99,9% uptime SLA: if monthly uptime falls below 99,9%, the subscription is extended by 10 days.
• Batch and domain queries, JSON, XML, CSV and other formats.
• No automatic renewal billing: the subscription expires unless you renew.

That's strong value, and the proxy and hosting flags are useful for risk checks. If you need unlimited volume, an SLA and a proxy flag, ip-api Pro is a better fit than IPAPI.GR, which has no SLA and no proxy detection.

When an alternative makes sense

ip-api, ipapi, ipapi, ipapi, ipapi: five different services

Search results mix these up constantly, and so do some comparison posts. They're unrelated companies with different terms:

Before you paste a code sample from a blog post, check which of these it targets. Their URLs, field names and keys are all different.

Field mapping: ip-api.com to IPAPI.GR

Migrating: server side

A typical ip-api.com call and its replacement, in Node.js:

// Before: free ip-api.com endpoint (HTTP only, non-commercial)
const r = await fetch(`http://ip-api.com/json/${ip}?fields=status,message,countryCode,city,as`);
const d = await r.json();
if (d.status !== 'success') throw new Error(d.message);
const result = { countryCode: d.countryCode, city: d.city, asn: d.as ? d.as.split(' ')[0].slice(2) : null };

// After: IPAPI.GR over HTTPS
const known = (v) => (v === undefined || v === null || v === '' || v === 'No Data' ? null : v);

const r = await fetch(`https://ipapi.gr/api/lookup/${encodeURIComponent(ip)}?key=${process.env.IPAPI_KEY}`,
  { signal: AbortSignal.timeout(2000) });
const d = await r.json();
if (!r.ok) throw new Error(d.message);            // 400 invalid input, 401 bad key, 429 daily limit
const result = { countryCode: known(d.country_code), city: known(d.city), asn: known(d.asn) };

The main behavioural changes:

• Errors are HTTP status codes, not a status field inside a 200. Check res.ok.
• Limits are per account per day, not per source IP per minute. The free plan allows 1.000 requests a day and resets at midnight UTC. GET /api/status shows what's left and doesn't count as a lookup.
• Missing values are the string "No Data", so normalise them as above.

If you used ip-api's batch endpoint, IPAPI.GR's batch lookup also takes up to 100 items, as {"ips": [...]}, and returns results in the order you sent them, each with a query field.

Migrating: in the browser

The reason many people leave the free ip-api.com endpoint is that it can't be called from an HTTPS page. IPAPI.GR is HTTPS-only and allows cross-origin requests, and GET /api/lookup/self returns the location of whoever makes the request, so the browser doesn't need to know its own IP:

<script type="module">
  // Use a key restricted to your website (Dashboard → API access → Allowed websites).
  const KEY = 'YOUR_BROWSER_KEY';
  try {
    const r = await fetch(`https://ipapi.gr/api/lookup/self?key=${KEY}`);
    if (r.ok) {
      const d = await r.json();
      if (d.country_code && d.country_code !== 'No Data') {
        document.documentElement.dataset.country = d.country_code;   // e.g. pick a currency in CSS/JS
      }
    }
  } catch { /* no geo: keep the defaults */ }
</script>

A key used in the browser is visible to anyone who opens your page. Restrict it to your site's host names in the dashboard. As the docs point out, a website restriction stops casual reuse but isn't strong security, because non-browser clients can fake the Origin header. For anything sensitive, look up the IP on your server instead. For server-side code in more languages, see get a visitor's country from their IP.

What IPAPI.GR adds, and what it doesn't

Adds: HTTPS on every plan, a free plan without a non-commercial clause (see the terms), IPv4, IPv6 and domain input, batch on every plan, up to 20 API keys with IP and website restrictions, per-key usage, usage alerts by email or webhook, and on every paid plan three flags that tell you whether an address belongs to a known AI crawler, crawler or scanner. You can see which bots are covered on the bot signals page and test any address with the bot verification tool.

Doesn't have: proxy, VPN, Tor, hosting or mobile flags, an SLA, unlimited requests (the largest plan, Scale, allows 1.000.000 a day), non-JSON formats, or a database download.

FAQ

Can I use ip-api.com for free in a commercial project?

No. The free endpoint's documentation says "We do not allow commercial use of this endpoint." Commercial use requires ip-api Pro.

Does ip-api.com support HTTPS?

Only on Pro. The free endpoint documentation says SSL "is not available for this free API".

Why does my ip-api.com call fail in the browser?

Most likely mixed content: your page is HTTPS and the free endpoint is HTTP, so the browser blocks it. Use a server-side call, ip-api Pro, or an API that serves HTTPS on its free tier.

Is ipapi.co the same as ip-api.com?

No. ipapi.co, ip-api.com, ipapi.com, ipapi.is and IPAPI.GR are five separate services with different endpoints, limits and terms. See the table above.

What's the best free ip-api.com alternative with HTTPS?

Among the providers we checked, ipgeolocation.io, ipapi.is and IPAPI.GR each offer 1.000 lookups a day over HTTPS with commercial use allowed. ipinfo Lite is unlimited and HTTPS but country-level only, with attribution. Compare the conditions in our free tier guide.

Is ip-api Pro or IPAPI.GR cheaper?

Both charge a flat monthly fee. ip-api Pro is 13,30 € a month on a 12-month term (excluding VAT) with unlimited requests and an SLA. IPAPI.GR's paid plans are billed monthly, VAT included, from Developer at 9,00 € for 10.000 requests a day up to Scale at 199,00 € for 1.000.000 a day, with bot flags on every paid plan and no SLA. For modest daily volumes IPAPI.GR costs less; for very high volume, ip-api Pro's unlimited plan does. Choose on the volume and features you need. More in IP geolocation API pricing.