---
title: "GeoIP lookup"
method: GET
path: "/api/geoip"
tags: ["geoip"]
---

# GeoIP lookup

`GET /api/geoip`

Server-side proxy for ipapi.co's IP geolocation lookup, used by the Timezone/GeoLocation "Lookup"/"Detect" buttons. It is fetched here rather than from the browser so that only the PLAYER's address is disclosed, and only when somebody presses the button -- and so that no third-party host has to appear in the CSP, which is where the rest of the UI has deliberately ended up.  (ipapi.co does send Access-Control-Allow-Origin: *, so a browser-side call is not blocked by CORS the way an older comment here claimed; connect-src is the only thing stopping it, and that is ours to decide rather than a technical obstacle.) The response also carries an `fpp` object naming the settings the lookup implies, so the mapping lives in one place instead of being reimplemented in the browser.  Every one of them is a SEED: the buttons fill the fields in, the user sees the result and can change it, and nothing is saved until they finish setup.  Any field the lookup cannot determine is simply absent, so the caller leaves that control alone rather than asserting a wrong answer. Note geoip resolves the PUBLIC IP: it says where the device reaches the internet, not where the device is.  Fine for something shown and correctable, which is the only way it is used.

## Response `200`

ipapi.co's JSON response, plus the settings it implies

- object

## Other responses

- `502` — Lookup failed

## Changes

- **2026-07-28** `09e446cb7926` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/falconchristmas/apis/fpp-api/changes/api/geoip/get.md)

---

[API](https://skmtc.dev/falconchristmas/apis/fpp-api.md) · [All operations](https://skmtc.dev/falconchristmas/apis/fpp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/falconchristmas/apis/fpp-api/revisions/ec7312fb5f8d?raw)