ipstack alternative: IP geolocation plus 150 endpoints

You're paying ipstack $9.99/month for one endpoint: IP geolocation. That's the entire product. When you need email validation next week, you'll sign up for another API with another key and another bill. DNS lookups? Another service. Hashing, JWT decoding, QR codes? Three more.

Botoi's /v1/ip/lookup returns the same city-level geolocation data ipstack provides, plus 150 more endpoints under a single API key. The free tier includes HTTPS (ipstack's doesn't), gives you 100 requests/day instead of 100/month, and covers VPN detection at no extra charge.

Side-by-side: ipstack vs botoi IP lookup

Both APIs geolocate an IP to city level. The request format and response structure differ. Here's each one looking up Google's public DNS (8.8.8.8).

ipstack request and response

# ipstack (free tier: HTTP only, no HTTPS)
curl "http://api.ipstack.com/8.8.8.8?access_key=YOUR_IPSTACK_KEY"

Response:

{
  "ip": "8.8.8.8",
  "type": "ipv4",
  "continent_code": "NA",
  "continent_name": "North America",
  "country_code": "US",
  "country_name": "United States",
  "region_code": "CA",
  "region_name": "California",
  "city": "Mountain View",
  "zip": "94043",
  "latitude": 37.4223,
  "longitude": -122.085,
  "location": {
    "geoname_id": 5375480,
    "capital": "Washington D.C.",
    "languages": [{"code": "en", "name": "English"}],
    "country_flag": "https://assets.ipstack.com/flags/us.svg",
    "country_flag_emoji": "\ud83c\uddfa\ud83c\uddf8"
  }
}

Notice the URL uses HTTP, not HTTPS. ipstack restricts HTTPS to paid plans. Your API key and the response data travel unencrypted on the free tier.

botoi request and response

# botoi (HTTPS on every tier, including free)
curl -X POST https://api.botoi.com/v1/ip/lookup \
  -H "Content-Type: application/json" \
  -d '{"ip": "8.8.8.8"}'

Response:

{
  "success": true,
  "data": {
    "ip": "8.8.8.8",
    "city": "Mountain View",
    "region": "California",
    "country": "US",
    "countryName": "United States",
    "latitude": 37.4223,
    "longitude": -122.085,
    "timezone": "America/Los_Angeles",
    "postalCode": "94043",
    "asn": 15169,
    "asnOrg": "Google LLC",
    "continent": "NA",
    "currency": "USD"
  }
}

Botoi uses HTTPS on every tier. The response includes timezone, ASN organization, continent, and currency code; fields ipstack gates behind higher plans or doesn't return at all.

Response field comparison

Both services return core geolocation fields. The differences are in what's included by default versus what costs extra.

Field	ipstack	botoi
City	All plans	All plans
Region / State	All plans	All plans
Country	All plans	All plans
Latitude / Longitude	All plans	All plans
Postal code	All plans	All plans
Timezone	All plans	All plans
ASN / ISP	All plans	All plans
Currency code	All plans (via location object)	All plans
Country flag / emoji	All plans	Not included
Languages	All plans	Not included
Continent	All plans	All plans
VPN / proxy / Tor detection	Security Module add-on ($49.99+/mo)	Free via /v1/vpn-detect
HTTPS	Paid plans only ($9.99+/mo)	All plans

The core geo fields are comparable. The main gaps: ipstack returns country flags, language data, and connection type fields that botoi doesn't. Botoi includes VPN detection and HTTPS on every tier where ipstack charges extra.

Pricing comparison

Plan	ipstack	botoi
Free	100 req/month, HTTP only, no security module	100 req/day (3,000/month), HTTPS, no signup required
Starter / Basic	$9.99/mo, 50,000 req, HTTPS, 1 endpoint	$9/mo, 300,000 req, HTTPS, all 150+ endpoints
Pro / Professional	$49.99/mo, 500,000 req, bulk lookups	$29/mo, 1,000,000 req, all 150+ endpoints
Business / Enterprise	$99.99/mo, 1,000,000 req, security module	$199/mo, highest rate limits, all 150+ endpoints

The free tier gap is even wider. ipstack gives 100 requests per month over HTTP with no encryption. Botoi gives 100 requests per day (roughly 3,000/month) over HTTPS with no account required.

VPN detection: included vs add-on

ipstack offers a "Security Module" that detects VPNs, proxies, Tor exit nodes, and known attackers. It's an add-on available on the Business plan ($49.99/month) and above. On the Basic and Professional plans, you can't access it at any price.

Botoi's /v1/vpn-detect endpoint is included in every tier, including free anonymous access.

curl -X POST https://api.botoi.com/v1/vpn-detect \
  -H "Content-Type: application/json" \
  -d '{"ip": "8.8.8.8"}'

Response:

{
  "success": true,
  "data": {
    "ip": "8.8.8.8",
    "isVpn": false,
    "isProxy": false,
    "isTor": false,
    "isDatacenter": true,
    "riskScore": "medium",
    "provider": "Google LLC"
  }
}

The response includes boolean flags for VPN, proxy, Tor, and datacenter connections, plus a risk score. For fraud prevention in checkout flows or geo-restriction enforcement, this covers the common use cases without an extra subscription.

What else you get with botoi

ipstack is an IP geolocation API. That's its entire product surface. Botoi is a developer tools platform with 150+ endpoints. When you create a botoi API key for IP geolocation, you also get:

• Email validation and disposable email detection (replaces Mailgun verify, ZeroBounce)
• DNS lookups, SPF/DMARC/DKIM checks (replaces MXToolbox API access)
• SSL certificate monitoring (replaces UptimeRobot's SSL checks)
• WHOIS and domain availability (replaces WhoisXML API)
• Hash generation, JWT signing/decoding (replaces hand-rolled utility functions)
• QR code and barcode generation (replaces QR Server, Barcode API)
• PDF generation from HTML and Markdown (replaces html-pdf-service)
• Website screenshot capture (replaces screenshotlayer)
• JSON-to-TypeScript, JSON-to-Zod schema conversion (replaces local tooling)
• Currency conversion and exchange rates (replaces Fixer.io)

All of these share the same API key, the same rate limit pool, and the same monthly invoice. The full list is in the API documentation.

# DNS lookup
curl -X POST https://api.botoi.com/v1/dns/lookup \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"domain": "google.com", "type": "A"}'

# Email validation
curl -X POST https://api.botoi.com/v1/email/validate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"email": "dev@company.io"}'

# SHA-256 hash
curl -X POST https://api.botoi.com/v1/hash \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"text": "hello world", "algorithm": "sha256"}'

# QR code generation
curl -X POST https://api.botoi.com/v1/qr/generate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"text": "https://botoi.com", "format": "png"}'

Migration: swap ipstack for botoi in Express

If you're using ipstack in Express middleware to geolocate incoming requests, here's the before and after.

Before (ipstack)

// BEFORE: ipstack in Express middleware
app.use(async (req, res, next) => {
  const ip = req.headers["x-forwarded-for"] || req.ip;
  const response = await fetch(
    `http://api.ipstack.com/${ip}?access_key=${process.env.IPSTACK_KEY}`
  );
  const geo = await response.json();

  req.geo = {
    city: geo.city,
    region: geo.region_name,
    country: geo.country_code,
    lat: geo.latitude,
    lng: geo.longitude,
  };
  next();
});

After (botoi)

// AFTER: botoi in Express middleware
app.use(async (req, res, next) => {
  const ip = req.headers["x-forwarded-for"] || req.ip;
  const response = await fetch("https://api.botoi.com/v1/ip/lookup", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.BOTOI_API_KEY}`,
    },
    body: JSON.stringify({ ip }),
  });
  const { data } = await response.json();

  req.geo = {
    city: data.city,
    region: data.region,
    country: data.country,
    lat: data.latitude,
    lng: data.longitude,
  };
  next();
});

Three changes: the URL switches from a GET with the IP in the path to a POST with the IP in the body. The access_key query parameter becomes a Bearer token. The response field names change slightly (region_name becomes region, country_code becomes country). Everything else stays the same.

Where ipstack is stronger

Honest comparison of where ipstack holds an edge:

• Arbitrary IP lookups. ipstack can geolocate any IP address you pass to it. Botoi's /v1/ip/lookup works for the caller's IP or IPs you pass in the body, with geolocation data sourced from Cloudflare's edge network. For offline batch processing of millions of IPs from log files, ipstack's database-backed approach or a self-hosted MaxMind GeoLite2 database is more appropriate.
• Country flags and language data. ipstack returns SVG flag URLs, flag emojis, and language metadata in every response. Botoi doesn't include these fields.
• Connection type. ipstack identifies whether the connection is broadband, cable, wireless, or dial-up. Botoi doesn't classify connection types.
• Threat intelligence. ipstack's Security Module includes threat scores and known-attacker detection. Botoi's VPN detection covers VPN, proxy, Tor, and datacenter flags but doesn't include reputation-based threat scoring.

If your product depends on deep IP intelligence across arbitrary addresses, ipstack's database-backed model gives you data botoi's edge-based approach can't match. If your use case is "geolocate my own visitors, block VPNs, and have 150 other developer endpoints available," botoi is the more cost-effective option.

Key points

• ipstack's free tier: 100 requests/month, HTTP only, no VPN detection. Botoi's free tier: 100 requests/day, HTTPS, VPN detection included, no signup.
• ipstack's $9.99/month Basic plan gives you 50,000 requests to one endpoint. Botoi's $9/month Starter plan gives you 300,000 requests across 150+ endpoints.
• VPN detection costs $49.99+/month on ipstack (Security Module add-on). It's free on botoi.
• ipstack is stronger for arbitrary IP lookups, country flag data, connection type detection, and threat intelligence scoring.
• Botoi is stronger for breadth: one key, one bill, 150+ endpoints covering IP geolocation, email validation, DNS, hashing, QR codes, PDF generation, and more.