How to Detect User Country from IP in Node.js (2026)

.50 |

Key Finding: Cloud-based IP geolocation delivers the optimal balance of sub-50ms latency, >99% country-level accuracy, and zero user friction. When paired with Redis caching and proper proxy header parsing, it eliminates rate-limit bottlenecks while maintaining compliance-ready routing for currency, timezone, and geo-restriction logic.

Core Solution

1. Extract the Real Client IP Behind Proxies

In production, applications sit behind reverse proxies (Nginx, Cloudflare, load balancers). The raw socket IP will return the proxy's address. Use header parsing to retrieve the original client IP:

function getClientIp(req: express.Request): string {
const forwarded = req.headers['x-forwarded-for'];
if (typeof forwarded === 'string') {
return forwarded.split(',')[0].trim(); // First IP is the original client
}
return req.socket.remoteAddress ?? '8.8.8.8';
}

If you're behind Cloudflare, use CF-Connecting-IP header instead — it's more reliable.

2. Basic Express.js Implementation

Query the geolocation endpoint and return structured routing data:

import express from 'express';
const app = express();
app.get('/api/session', async (req, res) => {
const ip = req.ip ?? req.socket.remoteAddress ?? '8.8.8.8';
const geoRes = await fetch(
`https://api.apogeoapi.com/v1/geolocate/${ip}`,
{ headers: { 'X-API-Key': process.env.APOGEO_API_KEY! } }
);
const geo = await geoRes.json();
// { country_code: 'DE', country_name: 'Germany', city: 'Berlin',
//   timezone: 'Europe/Berlin', currency: 'EUR', latitude: 52.5, longitude: 13.4 }
res.json({ country: geo.country_code, currency: geo.currency, timezone: geo.timezone });
});

3. Next.js Middleware / Edge Function

Deploy country detection at the edge to pre-populate cookies before page render:

// middleware.ts
import { NextRequest, NextResponse } from 'next/server';
export async function middleware(req: NextRequest) {
const ip = req.headers.get('x-forwarded-for')?.split(',')[0] ?? '8.8.8.8';
const geo = await fetch(
`https://api.apogeoapi.com/v1/geolocate/${ip}`,
{ headers: { 'X-API-Key': process.env.APOGEO_API_KEY! } }
).then(r => r.json());
const res = NextResponse.next();
res.cookies.set('geo_country', geo.country_code, { maxAge: 86400 });
res.cookies.set('geo_currency', geo.currency, { maxAge: 86400 });
return res;
}
export const config = { matcher: ['/((?!_next|api).*)'] };

4. Response Payload Structure

The API returns standardized fields for routing and localization:

• country_code — ISO2 code (e.g. "DE")
• country_name — Full name (e.g. "Germany")
• region — State or region name
• city — City name
• latitude, longitude — Coordinates
• timezone — IANA timezone string (e.g. "Europe/Berlin")
• currency — ISO 4217 currency code (e.g. "EUR")

5. Caching Strategy

IP geolocation data changes infrequently. Cache results in Redis with a 24-hour TTL to avoid hitting your API quota on every request:

const cacheKey = `geo:${ip}`;
const cached = await redis.get(cacheKey);
if (cached) return JSON.parse(cached);
const geo = await fetchGeo(ip);
await redis.setex(cacheKey, 86400, JSON.stringify(geo));
return geo;

Pitfall Guide

1. Proxy IP Masking: Using req.ip directly behind Nginx, AWS ALB, or Cloudflare returns the proxy's IP, not the client's. Always parse X-Forwarded-For (first comma-separated value) or CF-Connecting-IP to extract the true origin.
2. Unbounded API Calls: Failing to cache geolocation data leads to rapid quota exhaustion and increased p99 latency. IP-to-country mappings change infrequently, making short-to-medium TTL caching highly effective.
3. Blocking Edge Runtime: Performing unoptimized fetch calls in Next.js Edge Middleware without timeout handling or fallbacks can cause 504 Gateway Timeouts. Keep payloads minimal and implement circuit breakers for cold-start environments.
4. Over-Caching Roaming/VPN Users: A static 24-hour Redis TTL works for stationary users but fails for frequent travelers or VPN users. Implement dynamic TTLs or cache invalidation triggers based on session/token changes.
5. Ignoring IPv6 & IPv4 Fallbacks: Modern networks heavily utilize IPv6. Ensure your geolocation provider and client implementation handle dual-stack addresses gracefully without throwing type errors or connection timeouts.
6. Confusing Country Accuracy with City Precision: IP geolocation is highly reliable for country-level detection (>99%) but degrades significantly at city/ZIP levels due to carrier-grade NAT and ISP routing. Use country codes for compliance/currency, but avoid IP-based routing for hyperlocal logistics or legal jurisdiction enforcement.

Deliverables

• Blueprint: Node.js IP Geolocation Integration Blueprint — architecture flow covering proxy header extraction, edge middleware deployment, Redis caching topology, and fallback routing strategies.
• Checklist: Pre-flight validation checklist including proxy header verification, API key rotation, Redis TTL configuration, IPv4/IPv6 dual-stack testing, compliance audit (GDPR/CCPA geo-routing), and rate-limit monitoring setup.
• Configuration Templates: Production-ready .env template, Redis cache configuration snippet, Next.js middleware matcher pattern, and Nginx/Cloudflare proxy header forwarding directives for immediate deployment.