---
title: "Create a private anonymous browser location proof"
method: POST
path: "/v1/location-proofs"
---

# Create a private anonymous browser location proof

`POST /v1/location-proofs`

## Request

- Base URL: `https://loppee.com`
- URL: `https://loppee.com/v1/location-proofs`
- Auth: none required

Browser-only first-party UX route; not an external-agent or native-app API. After a visible user gesture and browser permission, accepts one fresh device-location reading from a same-origin Loppee fetch whose point is plausibly near the server-resolved client-IP city. Returns only an opaque short-lived proof id and binds it to a Secure HttpOnly SameSite=Strict cookie. Coordinates are encrypted and never returned or placed in a search URL. This is abuse-resistant consented location input, not device or coordinate attestation.

## Request body

- AnonymousLocationProofRequest
  - `latitude` number, required
  - `longitude` number, required
  - `accuracy_meters` number, required
  - `captured_at` string, date-time, required

## Response `201`

Anonymous browser location proof created.

- AnonymousLocationProofResponse
  - `location_proof_id` string, uuid, required
  - `status` 'ready', required
  - `usable_until` string, date-time, required
  - `uses_remaining` integer, required
  - `coordinates_returned` unknown, required

## Other responses

- `400`: The reading is stale, unsupported, or insufficiently accurate.
- `403`: The request is not a same-origin browser flow, has credentials, has no trustworthy coarse-IP result, or is implausibly far from that result.
- `429`: Too many anonymous location-proof requests.

---

[API](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents.md) · [All operations](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/revisions/37285f7cddcd?raw)