# Downloading & checksums

> Fetch database snapshots via HMAC-signed URLs, GCS V4 streaming redirects, ETag caching, and SHA-256 verification.

Database artifacts are served from `https://download.ipscope.io` using HMAC-signed download tokens generated in your [dashboard](https://dashboard.ipscope.io) or via authenticated API headers. When object storage offloading is active, the download server issues a `307 Temporary Redirect` to a Google Cloud Storage V4 signed URL so multi-hundred-megabyte artifacts stream directly from edge storage.

## Download URL structure

```bash Download .mmdb
curl -fSL "https://download.ipscope.io/v1/databases/ipscope-complete/latest.mmdb" \
  -H "Authorization: Bearer $IPSCOPE_KEY" \
  -o ipscope-complete.mmdb
```

```bash Download SHA-256 checksum
curl -fSL "https://download.ipscope.io/v1/databases/ipscope-complete/latest.mmdb.sha256" \
  -H "Authorization: Bearer $IPSCOPE_KEY" \
  -o ipscope-complete.mmdb.sha256

sha256sum -c ipscope-complete.mmdb.sha256
```

## Conditional downloads (`ETag` / `If-None-Match`)

Every snapshot response includes an `ETag` header matching the artifact’s SHA-256 digest and an `X-IPScope-Checksum-SHA256` header. Pass `--etag-save` and `--etag-compare` in `curl` so cron jobs receive `304 Not Modified` when no new build has been published:

```bash Conditional fetch with ETag
curl -fSL "https://download.ipscope.io/v1/databases/ipscope-complete/latest.mmdb" \
  -H "Authorization: Bearer $IPSCOPE_KEY" \
  --etag-compare /var/lib/ipscope/mmdb.etag \
  --etag-save /var/lib/ipscope/mmdb.etag \
  -o /var/lib/ipscope/ipscope-complete.mmdb
```

> **Tip:** Interrupted downloads can be resumed with `curl -C -` (`Range: bytes=...`). Always pass `-L` (`--location`) so `curl` follows GCS V4 signed URL redirects.