What does a CORS origin restriction do?
A paid-plan key can be created with an allowlist of browser origins. IPRout compares the request's Origin value with that list and permits cross-origin browser access only for an exact match. Starter supports up to 5 origins per key and Pro up to 10. Free keys are intended for open server-side use and do not expose configurable restricted-origin behavior in the public product interface.
What counts as an exact origin?
An origin is the combination of scheme, hostname, and port. https://app.example.com differs from http://app.example.com, https://www.example.com, and http://localhost:3000. Paths are not part of an origin, so https://app.example.com/dashboard is represented by https://app.example.com. List every intentional development, preview, and production origin separately, and avoid broad values that defeat the restriction.
What security does CORS provide?
CORS controls which browser pages can read responses using the key; it is not a replacement for keeping secrets out of public code. A determined user can inspect credentials delivered to their browser, and non-browser HTTP clients are not governed like a browser's same-origin policy. Prefer server-side calls for confidential keys. Use origin restrictions as an additional boundary when direct browser access is intentionally part of the design.
How do denied requests affect usage?
A request rejected by the CORS origin check does not consume lookup usage. That protects plan capacity from disallowed browser origins, but the failure should still be visible in application diagnostics. If cURL succeeds while a browser request fails, compare the exact Origin header with the key configuration. Scheme, subdomain, and development port mismatches are common causes.
How can I test an allowed origin?
Send an Origin header that exactly matches one configured value and use the key's normal authentication. Then test a deliberately different origin and verify the browser cannot read the response. The basic lookup remains unchanged; CORS is evaluated around it. Never place a live production key in a public documentation example.
curl --fail-with-body --max-time 10 \
-H "Authorization: Bearer $IPROUT_API_KEY" \
-H "Origin: https://app.example.com" \
https://api.iprout.com/ip/8.8.8.8How are origin changes deployed?
Allowed origins are immutable for an existing credential. Create a replacement with the new exact list, deploy it to the application, verify requests from every intended origin, and revoke the old key. Plans with spare active slots can overlap both credentials during rollout. Keep origin lists short, remove abandoned preview domains, and review them whenever frontend hosting changes.
Which IPRout plan fits this workload?
Use the 7-Day Developer Key for a short evaluation with 1,000 requests. Free supports ongoing low-volume use with 10,000 monthly requests and 1 active key. Starter adds 100,000 requests, 2 active keys, and up to 5 exact CORS origins per key. Pro provides 1,000,000 requests, 5 active keys, up to 10 origins per key, and a configurable 100 to 1,000,000 request cap when each key is created. All active account keys consume one shared monthly allowance.
| Plan | Monthly requests | Active keys |
|---|---|---|
| Free | 10,000 | 1 |
| Starter | 100,000 | 2 |
| Pro | 1,000,000 | 5 |
What are the key benefits?
This feature uses the same authenticated HTTPS interface and predictable JSON conventions as the rest of IPRout. That keeps the integration small while letting teams separate product logic from the details of IP intelligence and API key controls.
- Exact origin matching
- Starter: up to 5 origins
- Pro: up to 10 origins
How do I get started?
Generate a 7-Day Developer Key for evaluation or create an account key for an ongoing integration. Begin with the documented request, add status-aware error handling and a finite timeout, then connect only the response fields your product needs. Review usage before launch, keep the secret in trusted infrastructure, and follow the linked documentation for feature-specific configuration.