IPAPI.GR for Django

pip install requests
export IPAPI_KEY="your_api_key_here"

# myapp/ipapi.py: Django middleware that sets request.geo for the visitor's IP.
# pip install requests. Set IPAPI_KEY in the environment.
import ipaddress
import os

import requests
from django.core.cache import cache

LOOKUP = "https://ipapi.gr/api/lookup/"
TTL = 60 * 60  # keep answers for an hour
FIELDS = ("country", "country_code", "region", "city", "timezone", "asn", "isp")
_session = requests.Session()


def _known(value):
    # Missing values come back as the string "No Data".
    return None if value in (None, "", "No Data") else value


def client_ip(request):
    # REMOTE_ADDR is the address that connected to Django. Behind exactly one
    # reverse proxy you control, use the last X-Forwarded-For entry it appended:
    # return request.META["HTTP_X_FORWARDED_FOR"].split(",")[-1].strip()
    return request.META.get("REMOTE_ADDR", "")


def lookup(ip):
    try:
        addr = ipaddress.ip_address(ip)
    except ValueError:
        return None
    if not addr.is_global:  # private, loopback, link-local: nothing to look up
        return None

    cache_key = f"ipapi:{addr}"
    data = cache.get(cache_key)
    if data is not None:
        return data
    try:
        r = _session.get(LOOKUP + str(addr), params={"key": os.environ["IPAPI_KEY"]}, timeout=1.5)
        r.raise_for_status()
        body = r.json()
    except (requests.RequestException, ValueError):
        return None  # timeout, network or API error: fail open
    data = {field: _known(body.get(field)) for field in FIELDS}
    data["risk"] = body.get("risk")  # {"is_ai", "is_crawler", "is_scanner"} on paid plans only
    cache.set(cache_key, data, TTL)
    return data


class IpapiMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        request.geo = lookup(client_ip(request))
        return self.get_response(request)

# settings.py
MIDDLEWARE = [
    # ... Django's own middleware first
    "myapp.ipapi.IpapiMiddleware",
]

# lookup() uses the default cache. Django falls back to per-process memory;
# with several workers, a shared cache (Redis, Memcached) saves more requests.

# myapp/views.py
import re

from django.http import HttpResponseForbidden, JsonResponse

AI_CLAIM = re.compile(r"GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|Claude-SearchBot|Claude-User|PerplexityBot|Perplexity-User", re.I)


def home(request):
    geo = request.geo or {}
    risk = geo.get("risk")
    # Paid plans: a request that claims to be an AI crawler must come from a known AI crawler address.
    if risk and AI_CLAIM.search(request.headers.get("User-Agent", "")) and not risk["is_ai"]:
        return HttpResponseForbidden("Unverified crawler")
    return JsonResponse({"country": geo.get("country_code"), "timezone": geo.get("timezone")})