Authentication

Present your API key any of three ways, whichever suits your client:

curl -H "Authorization: Bearer $KEY" https://api.vpndetection.io/45.83.91.1
curl -H "X-Api-Key: $KEY"            https://api.vpndetection.io/45.83.91.1
curl "https://api.vpndetection.io/45.83.91.1?apikey=$KEY"

They are the same key. The query parameter exists for curl and the browser; prefer a header where setting one is easy. Create a key in the console.

Lookup takes a key optionally

GET /{ip} answers without one, returning ip and is_vpn. A key widens that answer: which fields come back is decided by the plan behind the key, and a field your plan doesn't include is absent rather than false. Test for presence, not truthiness, or an unlicensed field reads as a negative result.

A key is also what raises your quota above the keyless allowance. See Rate Limits.

Database downloads require one

Every /api/v1/database/* endpoint needs a key carrying the db.download scope, and that key's organization has to hold a license for the dataset being asked for. A key without the scope answers 401. A valid key whose organization holds no license for that dataset, or whose term has ended, answers 403.

The two halves answer failures differently

Lookup returns a human-readable message:

{
  "error": "not a valid IP address"
}

The database endpoints return a result code:

{
  "rc": "UNAUTHORIZED"
}

Both are documented per endpoint in the reference. A missing or invalid key is 401 on either.