Docs

Authentication

Every request to the GeoQ API is authenticated with an API key, sent in the x-api-key header.

API keys

  • Keys look like geoq_live_xxxxxxxxxxxxxxxx.
  • Create and revoke named keys in your dashboard — one per environment (staging, production, CI). Every plan supports multiple keys: 3 on Free, 5 on Starter, 10 on Growth, unlimited on Scale and Pro.
  • Treat keys as secrets — never commit them or expose them in client-side code.

Sending the key

$ curl "https://api.geoq.io/v1/check?ip=8.8.8.8" \
    -H "x-api-key: geoq_live_xxxxxxxxxxxx"

Where to call from

Call GeoQ from your server, not the browser, so your key stays private. The interactive widgets on this site show a sample response by default; running one live needs a free key, just like your app. Always call GeoQ from your server so your key stays private.

Rotating keys

Create a new key, deploy it, then revoke the old one. Both work during the overlap so you can rotate with zero downtime.

# 12-factor style: keep the key in the environment
export GEOQ_API_KEY="geoq_live_xxxxxxxxxxxx"

Unauthenticated requests

A request with no key, or an invalid/revoked key, returns 401 Unauthorized. See errors.