API keys
The API stays keyless. A key exists only to raise the ceiling: 10,000 requests a day and 120 a minute, counted per key rather than per address.
Ask for a key
Enter an address you can read. We send one link, it works once, and it expires in 15 minutes. Opening it issues the key and shows it a single time.
What a key changes
| Surface | Without a key | With a key |
|---|---|---|
| /ip, /json, /ip.md, /api/v1/ip | 60 a minute per address, no daily cap | 120 a minute, 10,000 a day per key |
| /api/v1/lookup, /dns, /rdap, /reverse, /blacklist, /mx, /ssl | 20 a minute, 200 a day per address | 120 a minute, 10,000 a day per key |
| Privacy enrichment (?full=1, ?privacy=1) | 20 a day per address | 20 a day per address, unchanged |
The counters reset at 00:00 UTC.One account holds up to 5 live keys.Privacy enrichment costs a third-party credit, so a key does not raise it.
Sending the key
Put the key in an Authorization header. That keeps it out of logs, proxies and browser history.
curl -H "Authorization: Bearer wmi_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
https://whatsmyip.fyi/jsonA ?key= query parameter works too, for the places a header cannot reach. It is the weaker option, because query strings are written to logs along the whole path.
curl "https://whatsmyip.fyi/json?key=wmi_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"Keyed answers carry X-RateLimit-Limit, X-RateLimit-Remaining andX-RateLimit-Reset. An unknown or revoked key returns 401 with a link back to this page. A key over its quota returns 429 with Retry-After.
Never put a key in front-end JavaScript. A browser call reports the address of the visitor, and anyone reading the page reads the key with it. Call the API from your own server and pass the result down.
Already have a key
The dashboard at /api-keys/dashboard shows every key on your account with its usage today and this month, and holds the revoke and rotate buttons. It needs the sign-in cookie, so ask for a fresh link above if you are signed out.
About this tool
A free API key raises the published rate limits to 10,000 requests a day and 120 a minute. Sign in with an email link, copy the key once, and watch the usage on the dashboard.
Questions people ask
- Do I need a key to use this API?
- No. Every endpoint stays free and keyless at 60 requests a minute for the address endpoints and 20 a minute for lookups. A key raises those numbers; it does not unlock anything.
- Why an email address rather than a password?
- A password is one more secret for you to keep and one more thing for us to lose. The link in your inbox proves you hold the address, and that is all the proof the key issuance needs.
- What do you keep about me?
- A hash of your email address, the hash of each key, and a per-day request count per key. The plain address is written only into the pending sign-in link and is deleted when that link expires or is used.
- I lost the key. Can you show it again?
- No. Only a SHA-256 hash of it is stored, so nobody can read it back, us included. Sign in again and rotate the key. The old one stops working at once.