> I would like to be able to check if they are among my customers via a simple API call, but I want to preserve people's privacy so that they do not have to log

> I would like to be able to check if they are among my customers via a simple API call, but I want to preserve people's privacy so that they do not have to log in or authenticate in any way, and without actually transmitting their information or IP address. > I don't want them to tell me their IP address in detail, since this would just compromise their privacy and increase their attack surface area. I don't see the point, your server knows their IP address anyway, and I bet you log it too. It seems overcomplicated and unnecessary.