Registrar APIs: What You Can Automate, and What Every Provider Gates

The short answer

Past roughly fifty domains, the registrar control panel stops being a tool and starts being the bottleneck. Checking renewals, auditing nameservers, updating DNS across a portfolio, or pricing a bulk acquisition are all jobs a panel makes you do one row at a time.

Every major registrar publishes an API for this. They differ in one respect that matters more than feature lists: how much they let you do before you have an account and a key.

The plumbing underneath

Registrars do not talk to registries in JSON. They speak EPP, the Extensible Provisioning Protocol (RFC 5730 through 5734) — an XML protocol over TLS that defines what a domain object is and which state transitions are legal.

You will almost certainly never touch EPP. But it explains the API surface you do see: check availability, create, renew, transfer, update contacts, update nameservers, delete. Those are EPP operations with a friendlier wrapper, which is why every registrar API looks broadly alike, and why none of them will let you do something the registry does not permit.

It also explains the authorisation code — the EPP auth code — that a transfer requires. It is a registry-level secret proving you control the object, not a registrar convenience.

Porkbun: the price list is public

Porkbun publishes its complete pricing at a URL that needs no account, no key and no header:

https://api.porkbun.com/api/json/v3/pricing/get

Read on 23 August 2026 it returned "status": "SUCCESS" and pricing for 907 extensions, each with registration, renewal and transfer as separate figures:

Two things are worth noticing beyond the numbers.

First, publishing renewal next to registration in a machine-readable form is unusual, and it makes the gaps visible without any effort. .io registers at $28.12 and renews at $51.80 — a renewal 84% above the first year, on an extension marketed heavily to startups. .org shows the same shape at a smaller scale. That is the information a first-year price comparison is designed not to show you, and here it is in the same object.

Second, .ai's transfer price is double its renewal, which is a registry-level quirk rather than a registrar markup, and exactly the kind of thing that only surfaces when the data is queryable.

The rest of Porkbun's API — creating, updating, DNS management — needs an API key and a secret key, generated in the account, and each domain must additionally be switched to API-enabled individually. That per-domain toggle is a genuine safety feature and a genuine annoyance at scale.

Prices move. These were read on one day and are not a quote.

Namecheap: sandbox first, then an allow-list

Namecheap runs two environments, and its documentation is emphatic about using the first before the second:

• sandbox https://api.sandbox.namecheap.com/xml.response
• production https://api.namecheap.com/xml.response

The sandbox is open — sign up for a free sandbox account, enable API access, and test everything against it. Namecheap's own docs say there is no restriction on trying the APIs there.

Production is gated twice. Access must be enabled on the account, and Namecheap states you must meet its requirements to do so — its documentation says to contact support if you do not meet them, without enumerating them on that page, so treat any specific threshold you read elsewhere as unverified until Namecheap states it. Second, and non-negotiable, you must allow-list at least one IP address before the API will work at all, and Namecheap's docs specify that only IPv4 addresses can be used.

That IPv4 restriction is the detail that catches people out in 2026. A modern container host or serverless function may egress over IPv6 by default, and the API will simply refuse it. If you are automating from anything without a stable IPv4 address, you need a fixed egress path before you write a line of code.

Responses are XML, not JSON, which dates the API but does not diminish it.

Namecheap and Dynadot both expose full registration, renewal and DNS management through their APIs; Dynadot's is particularly oriented toward portfolio and aftermarket work, which is consistent with the rest of its product.

What is worth automating

Not everything. The jobs that repay the effort are the ones where a missed row costs money or availability:

• Expiry auditing. Pull every domain's expiry date on a schedule and alert on anything inside 60 days that is not on auto-renew. This is the one that pays for the whole exercise, once.
• Nameserver drift. Compare the nameservers each domain actually has against what you believe they have. Portfolios accumulate names pointing at hosts that were decommissioned years ago.
• Renewal cost forecasting. Join your domain list against a live price feed and you have next year's renewal bill before it arrives, extension by extension.
• Availability checks at volume. Registrar availability endpoints are rate-limited and are not the same as querying a registry; for a straight "is this registered", RDAP is the honest, keyless answer.
• DNS record deployment. Pushing an identical SPF or verification record across fifty zones is an API job and a terrible panel job.

What is usually *not* worth automating: acquisition. Buying at volume through an API is how people end up owning four hundred names they cannot service. See domain investing basics and the more sober arithmetic in the domain flipping guide.

Rate limits, idempotency and the boring failures

Three things go wrong in every registrar integration, and they are the same three every time.

Rate limits are real and mostly undocumented. Back off exponentially and cache aggressively. A price list does not need fetching more than daily.

Registration is not idempotent. If a create call times out you do not know whether it succeeded. Always follow a timeout with a read before you retry, or you will register the same name twice — or worse, fail to register it while believing you did.

Sandbox is not production. Sandbox registries accept names that production will reject, and the price data there is fictional. Test flows in the sandbox; never test *pricing* there.

Where to start without writing code

If the goal is a one-off bulk check rather than a system, the bulk domain checker here does availability across a list without an account, and how to register domains in bulk covers the manual path and its traps.

If you want to compare what registrars charge before committing a portfolio to one, the registrar comparison and best domain registrars 2026 hold the current figures we could verify.

The honest summary

Porkbun is the easiest registrar to build against and the only one whose full price list is a public URL. Namecheap has the deeper API and gates it behind an IPv4 allow-list that will surprise anyone deploying from modern infrastructure. Dynadot sits between them with a portfolio bent.

Automate expiry auditing first. It is a short script, it runs once a day, and it is the only one of these jobs where forgetting costs you the domain.