Login Activity with IP Geolocation

From IP to context

How to add IP geolocation to login activity

After a successful login, your backend captures the client IP, looks up that explicit address, and stores only the response fields needed by your activity page. A server-side request to GET /ip would look up your backend's caller IP instead of the person signing in.

1. 01

   Login

   Record the authentication event and time.

2. 02

   Client IP

   Resolve the address through trusted proxy settings.

3. 03

   IPRout

   Call GET /ip/{ip} with a server-side API key.

4. 04

   Activity

   Save selected context for the account history.

A login history users can understand

Show time, approximate place, address, and network together. A location label helps someone recognize a session, but it should not be presented as their precise physical position.

Laravel implementation

Capture a successful login event

This example listens for Laravel's login event, requests context for the captured IP, and writes a record even if enrichment fails. Configure services.iprout.key from a server-side environment variable and create the activity table with the columns below.

<?php

namespace App\Providers;

use Illuminate\Auth\Events\Login;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\ServiceProvider;

class AppServiceProvider extends ServiceProvider
{
    public function boot(): void
    {
        Event::listen(Login::class, function (Login $event): void {
            $ip = request()->ip(); // Trust only your own proxies.
            if ($ip === null) return;
            $context = [];

            try {
                $context = Http::withToken(config('services.iprout.key'))
                    ->timeout(2)
                    ->get('https://api.iprout.com/ip/' . rawurlencode($ip))
                    ->throw()
                    ->json();
            } catch (\Throwable $error) {
                report($error); // Never log your API key.
            }

            DB::table('login_activities')->insert([
                'user_id' => $event->user->getAuthIdentifier(),
                'ip_address' => $ip,
                'country' => $context['country'] ?? null,
                'city' => $context['city'] ?? null,
                'timezone' => $context['timezone'] ?? null,
                'asn' => $context['asn'] ?? null,
                'organization' => $context['organization'] ?? null,
                'logged_in_at' => now(),
            ]);
        });
    }
}

A synchronous lookup can add up to the configured timeout to login. For production, consider dispatching a queued job with the captured user ID, IP, and timestamp, so API latency does not hold up authentication. Handle invalid addresses and API errors without preventing login.

IP addresses and login activity may be personal information depending on context and jurisdiction. Keep only what you need, restrict access, and set an appropriate retention period.

Focus on your authentication experience

With a GeoIP API, your team does not need to download and refresh location datasets or operate separate IPv4, IPv6, and ASN lookup infrastructure. IPRout works through ordinary HTTP requests from Laravel, PHP, Node.js, Python, and other backend environments.