Error reference

The value in the path is not a valid IPv4 or IPv6 address.

Fix: Send a literal address such as 8.8.8.8 or 2001:4860:4860::8888. Hostnames are not resolved — resolve them yourself first.

The address is private, loopback, link-local, or otherwise reserved, so it has no public geolocation.

Fix: Only look up publicly routable addresses. Use the ipInfo fields to classify an address before looking it up.

The GeoLite2 databases are not loaded yet — normally only during the first minutes after a cold start.

Fix: Retry shortly. If you are self-hosting, check that a MaxMind licence key is configured.

The lang parameter is not one we support.

Fix: Use one of: en, de, es, fr, ja, pt-BR, ru, zh-CN.

format=jsonp was requested without a callback, or the callback is not a valid JavaScript identifier.

Fix: Pass callback=myFunction using letters, digits, underscore, or dollar sign, up to 64 characters.

A batch request arrived with an empty or missing ips array.

Fix: Send a body of the form {"ips": ["8.8.8.8", "1.1.1.1"]}.

A batch may contain at most 100 addresses.

Fix: Split the work into chunks of 100 or fewer.

The endpoint requires a key and none was supplied.

Fix: Send your key as the X-API-Key header, an Authorization: Bearer header, or a ?key= query parameter.

The key is valid but does not carry the scope this endpoint needs.

Fix: Create or rotate the key with the required scope — lookup.read for lookups, batch.lookup for batch.

The feature is not available on the Free plan.

Fix: Upgrade from the billing page in your dashboard.

A scope named when creating a key is not one we recognise.

Fix: Valid scopes are lookup.read, batch.lookup, usage.read, and account.read.

The key label is empty or too long.

Fix: Use a short descriptive label, for example “production web app”.

The requested expiry is out of range.

Fix: Choose between 1 and 365 days, or omit it for a key that does not expire.

An entry in the key's IP allow-list is not a valid address or CIDR block.

Fix: Use addresses or CIDR blocks such as 203.0.113.4 or 203.0.113.0/24.

Your plan's maximum number of API keys already exists.

Fix: Revoke a key you no longer use, or upgrade for a higher limit.

No key with that id belongs to your account.

Fix: List your keys to get the current ids — a revoked key is gone for good.

The keyless limit of 45 requests per minute was exceeded, or a wider per-network limit was hit.

Fix: Back off until the time in the Retry-After header, or use an API key for a much higher allowance.

Your plan's monthly request quota is exhausted. Requests beyond quota are refused, never billed.

Fix: Wait for the reset shown in X-RateLimit-Reset, or upgrade your plan.

The address or network has been blocked for abuse.

Fix: Contact support if you believe this is a mistake.

The email or password is incorrect.

Fix: Check both, or sign in with an emailed code instead.

The email address is not well-formed.

Fix: Supply a valid address.

An account with this email already exists.

Fix: Sign in instead, or use the emailed sign-in code if you have forgotten the password.

Passwords must be at least 8 characters.

Fix: Choose a longer password.

This account has been suspended.

Fix: Contact support.

The refresh token is expired, revoked, or unknown.

Fix: Sign in again to get a new token pair.

The emailed code is wrong, expired after 10 minutes, or was attempted too many times.

Fix: Request a new code.

The authenticator or recovery code did not match.

Fix: Check your device clock is accurate, or use a recovery code.

The short-lived ticket issued after the password step has expired.

Fix: Sign in again with your password to get a new ticket.

You tried to enrol while two-factor is already active.

Fix: Disable it first if you want to enrol a new device.

The current password did not match, or the account has no password because it was created through Google.

Fix: Check the password, or use the reset flow for OAuth-only accounts.

The email verification link is wrong, already used, or older than 24 hours.

Fix: Request a fresh link from your dashboard.

You asked to resend verification for an address that is already confirmed.

Fix: No action needed.

The Google credential could not be verified.

Fix: Try signing in with Google again.

The server has no Google client id configured.

Fix: Use email and password, or an emailed sign-in code.

No active session with that id belongs to your account.

Fix: List your sessions again — it may already have been revoked.

No account matches the identifier supplied.

Fix: Check the id or email.

Payments are not enabled on this deployment.

Fix: Contact support if you are trying to subscribe.

Stripe returned an error we could not handle.

Fix: Try again shortly. If it persists, contact support with the time of the attempt.

You opened the billing portal before subscribing to anything.

Fix: Start a subscription first.

The plan requested at checkout does not exist.

Fix: Choose a plan from the pricing page.

A request to our Stripe webhook failed signature verification.

Fix: This endpoint is for Stripe only — you should not be calling it.

The support ticket is missing a subject or message, or the field is too long.

Fix: Supply both a subject and a message body.

An admin abuse rule is malformed.

Fix: Use a valid IP, CIDR block, or AS number.

The account cannot be suspended — for example, it is your own or another admin's.

Fix: Admins cannot suspend themselves or other admins.

The account is not currently suspended.

Fix: No action needed.

The account cannot be promoted to admin.

Fix: The account may already be an admin.