ip_lookup_not_allowed

403. ?ip= needs a secret key. Either a publishable key was used, or no key was sent at all.

{
  "error": {
    "code": "ip_lookup_not_allowed",
    "message": "Looking up another address needs a secret key."
  }
}

Why

A publishable key sits in your page source where anyone can read it, and that is fine for its intended job: the origin allowlist is what stops somebody else using it on their own site.

The allowlist cannot help here. A lookup is made server to server and sends no Origin header at all, so if ?ip= worked with a publishable key, anyone who copied it out of your HTML could run a free address-lookup service billed to your quota.

Fix it

Create a secret key and call from somewhere that can keep it, meaning your own backend rather than the browser.

curl "https://api.instantgeo.info/v1/geo?ip=203.0.113.7" \
  -H "authorization: Bearer $INSTANTGEO_KEY"

If you wanted the location of the person viewing the page, you do not need ?ip= at all. Call from the browser with your publishable key and the answer is about them already.

Calling without a key

Requests with no key work for the caller’s own location, but never for ?ip=. The parameter is refused rather than ignored: handing back your own location when you asked about somebody else would be a wrong answer that looks like a right one.