IP Geolocation API Free Tier Limits: What to Compare
An IP geolocation API free tier is a capped allowance of lookups, usually measured per day, per month or per minute, that lets you test or run a small project without paying, and the cap is only one of several limits worth comparing.
Providers describe their allowances in very different units, which makes a straight comparison of headline numbers misleading. Published limits also change often. This article therefore avoids quoting other providers' figures and instead gives you the checklist to apply to each provider's current documentation, plus the exact terms ipto uses so you can compare like with like.
Rate limits, quotas and burst allowances are different things
A rate limit controls speed: how many requests you can send in a second or a minute before the server answers with an error such as HTTP 429. A quota controls volume: how many requests you can make in a day or a month in total. A provider can have one, the other, or both, and they fail in different ways.
A per-minute limit with no monthly cap suits a low-traffic site but can break a batch job that sends thousands of lookups in a burst. A monthly quota with no per-minute limit suits batch work but gives a production service no warning before the allowance runs out on the twentieth of the month. Daily quotas sit between the two and reset on a schedule you can plan around, as long as you know whether the reset is at midnight UTC, a rolling 24 hours, or tied to your signup time. Provider docs should say which.
When you read a free-tier page, write down four numbers: the burst or per-minute ceiling, the daily or monthly quota, the behaviour at the limit (hard error, throttling, or automatic overage billing), and whether response headers expose your remaining allowance. Treat any provider that does not state these clearly as a risk for production use.
What "unlimited" and "free" can hide
The word "unlimited" in a pricing table rarely means what an engineer wants it to mean. It may describe requests per minute rather than per month, it may carry a fair-use clause, or it may apply only to a reduced set of fields. The safest approach is to read the terms of service rather than the pricing page and look for fair-use, throttling and acceptable-use language.
Free tiers often differ in three other ways that matter more than the request count:
- Field gating. Basic location may be included while network, security or VPN-related fields sit in a paid plan. Check which response fields you actually need before you compare quotas.
- Commercial use. Some free plans are explicitly for development, testing or non-commercial projects. Shipping to production on such a plan can breach the terms.
- Signup and key requirements. Keyless access is convenient for a quick test, but a key lets the provider attribute traffic to you and sometimes unlocks a higher allowance.
For all of these, the authoritative source is the provider's current documentation. Numbers quoted in blog posts, including older versions of this one, go stale quickly.
How to size your own traffic against a quota
Quota comparison only makes sense against your real usage. Estimate lookups per day from your traffic: if every page view triggers a lookup, you will burn through any free allowance fast. If you only look up an address at sign-up, checkout or login, the volume is a small fraction of page views.
Caching changes the arithmetic. Location and network ownership for an address change slowly, so caching a result for hours or a day is reasonable for most uses. Store the response keyed by IP and you pay for each unique address once per cache window, not once per request. For bulk work, see our write-up on bulk lookup architecture, which covers queues and backoff.
Also plan for the failure path. Decide in advance what your application does when the API returns an error or a limit response: fail open and skip the enrichment, fail closed on high-risk actions, or serve a cached value. A free tier is a reasonable starting point only if your code degrades gracefully when the allowance is gone.
What ipto's free tier includes
ipto is free with no signup and allows 1,000 free requests per day. The IP lookup returns country, city, ASN, organisation, currency code and the flags is_vpn, is_tor, is_abuser, is_datacenter, plus bogon and bogon_type. Those fields are not held back behind a different plan, so the check above on field gating is answered in one line. Threat feeds refresh every 6 hours and the IP and ASN datasets refresh daily. The service does not detect residential proxies, and city-level location is approximate by nature, as explained in why city accuracy is limited.
You can try the data without writing code. Paste an address into the VPN, Tor and proxy checker to see the security flags, look up the network owner with the ASN lookup, see how an address is rated on the IP abuse checker, or read the API documentation for request formats. Whatever provider you pick, run the same sample of addresses from your own traffic through each candidate before committing, because coverage and accuracy vary by region and network type.