CORS / Web calls

Call the API straight from your frontend with no API key and no backend. The browser is the visitor, so the API reads the IP and user agent from the request itself.

Your ACCOUNT_ID and full endpoint URL are shown in the CORS domains section of your dashboard.

Before you start: register your domain

CORS calls are authenticated by the page's origin. Add every domain that will call the API under CORS domains in your dashboard. Requests from any other origin are rejected.

• Register the hostname only, e.g. example.com. Scheme and port are ignored.
• Matching is exact. www.example.com and app.example.com are separate domains from example.com.
• Changes take effect within a few minutes of saving.

Request

A plain GET to /. No body, no query string, no API key.

The visitor's IP comes from the connection itself. Don't add custom headers like Authorization or Content-Type. They make the browser send a preflight OPTIONS request, which this endpoint doesn't answer, and the call fails.

const ACCOUNT_ID = "YOUR_ACCOUNT_ID";

// No key, no body. The browser IS the visitor, so the API reads ip/ua
// straight off the request. Your domain must be registered first (see
// your dashboard) or this is rejected.
const response = await fetch(`https://${ACCOUNT_ID}.web.getvisitor.info/`);
const data = await response.json();
console.log(data);

With error handling:

async function getVisitor() {
  try {
    const response = await fetch(`https://${ACCOUNT_ID}.web.getvisitor.info/`);
    if (!response.ok) return null;
    return await response.json();
  } catch {
    // Rejected (unregistered domain, quota, rate limit) or network failure.
    return null;
  }
}

Response

200 OK with a single JSON object, the same shape as an API call response.

{
  "location": {
    "country": "Germany",
    "country_code": "DE",
    "continent": "Europe",
    "eu": true,
    "state": "Hesse",
    "city": "Frankfurt am Main",
    "languages": [{ "code": "de", "rtl": false }],
    "privacy_regime": { "name": "GDPR", "consent": "OPT IN" }
  },
  "device": {
    "type": "mobile",
    "os": { "name": "Android", "version": "14" },
    "browser": { "name": "Chrome", "version": "126" }
  },
  "asn": { "id": 3209, "name": "Vodafone GmbH", "threat_level": "normal" },
  "commerce": {
    "currency": { "code": "EUR", "symbol": "€", "fx_usd": 1.16, "fx_eur": 1.0 },
    "buying_power": 0.79,
    "sales_tax": {
      "label": "VAT",
      "rate": 19.0,
      "rate_with_local_addons": { "min": 19.0, "max": 19.0 },
      "threshold": 0.0
    }
  },
  "lookup_latency_ms": 0.04
}

Response headers:

The browser caches the response for 15 minutes. Calling it again on the next page load or component mount is served from the browser cache, with no request and no lookup counted.

Response fields

Any field can be null when the data isn't known for that visitor. Without an IP, every location, asn and commerce field is null. Without a user agent, device is null.

Limits

Paid limits scale with the number of units on your subscription.

CORS lookups have their own monthly quota, separate from API calls. The account-wide request rate is shared between the two. There are no connection limits on CORS calls.

Going over a rate limit returns 429. Traffic that stays well above the limit (about 20% over) is dropped without a response.

Errors

429 reasons

Every 429 carries Retry-After: 60 and an X-Rate-Limit-Reason header: