No third-party black boxes. No vendor lock-in. Just clean Python code, two free data sources, and a live API on RapidAPI. The stack FastAPI — async endpoints, automatic Swagger docs IPLocate.io — primary geo source (VPN/proxy/Tor detection on free tier) ipgeolocation.io — automatic fallback In-memory TTL cache — LRU cache, 1h TTL, 10k entries Render — auto-deploy from GitHub on every push RapidAPI — marketplace distribution, billing, rate limiting What it does GET /ip/{ip} — full geolocation for any IPv4 or IPv6 GET /ip/me — auto-detect caller's IP POST /ip/bulk — up to 50 IPs in one request Security flags on every response: VPN, Tor, proxy, datacenter The architecture decision that matters Two geo sources with automatic failover. If IPLocate goes down, ipgeolocation.io takes over silently. The client never sees a 502. Cache handles repeated lookups without touching either upstream API.…