---
title: Selling Domains Through Namecheap
description: "Namecheap's reseller API covers registration, transfer, renewal, nameservers, registrar lock, WhoisGuard privacy, bulk availability and a full domain listing. Its two awkward corners are strict IP allowlisting on an IPv4-only parameter, and the absence of any API command to fetch…"
url: "https://rackhelm.com/documentation/registrar-namecheap/"
updated: "2026-09-24"
category: "Integrations: Domains & SSL"
---

# Selling Domains Through Namecheap

Namecheap's reseller API covers registration, transfer, renewal, nameservers, registrar lock, WhoisGuard privacy, bulk availability and a full domain listing. Its two awkward corners are strict IP allowlisting on an IPv4-only parameter, and the absence of any API command to fetch an EPP code. This article is for operators; for how domain orders flow through the platform in general, read [How domain registration works in RackHelm](/docs/how-domain-registration-works/) first.

> **Warning:** The Namecheap driver has not been verified against a live Namecheap account. It was written to the published API. Run it in the sandbox and place one real order before selling through it.

## Before you start

- API access enabled on the Namecheap account under **Profile → Tools → Business & Dev Tools → Namecheap API Access**. Namecheap grants production API access only to accounts meeting one of: 20 or more domains, a balance of $50 or more, or $50 or more spent in the last two years.
- An API key from that same screen.
- This server's public **IPv4** address added to **Whitelisted IPs** there. Every call fails without it, and Namecheap does not accept IPv6.
- The `edit_integrations` permission.

## Configure the panel

1. Open **Integrations → Namecheap** (`/admin/panels/namecheap`).
2. Fill the fields below.
3. Press **Test API**. RackHelm calls `namecheap.users.getBalances` and reports the available balance and currency on success.
4. Press **Save**.

![The Namecheap panel with API user, API key, username, client IP, sandbox switch and timeout](/wp-content/uploads/rackhelm-docs/integrations-domains-namecheap-panel.png)
Client IP is the address Namecheap sees the call coming from — not the browsing customer's address.

### Field reference

| Field | What it does |
| --- | --- |
| **Name** | Display label. Defaults to `Namecheap`. Up to 120 characters. |
| **Active** | Master switch for the panel. |
| **API User** | Required. Your Namecheap account username. |
| **API Key** | Issued under Profile → Tools → Namecheap API Access. Never rendered back — **leave blank to keep the stored value**. |
| **UserName** | Optional. Only needed if you manage sub-accounts; defaults to the API User at call time. |
| **Client IP** | Optional IPv4 override of the auto-detected server address. Validated as IPv4 — an IPv6 address is rejected by the form. |
| **Use Namecheap sandbox environment** | Switches between `api.sandbox.namecheap.com` and `api.namecheap.com`, and stores a `mode` of `test` or `live`. |
| **HTTP Timeout (sec)** | Seconds to wait. Field default 30, minimum 5. A blank value is not stored at all, so the driver's own 60-second fallback applies. |

### How Client IP is resolved

Namecheap's `ClientIp` must be the address the API call originates from — the server's, never the visiting customer's. RackHelm resolves it in this order:

1. The panel's **Client IP** field, if it is a valid IPv4 address.
2. **Platform Settings → General & System → External IP**, if that is valid IPv4.
3. The resolved server hostname.
4. `127.0.0.1`, which Namecheap will reject.

> **Note:** The sandbox at `sandbox.namecheap.com` is a completely separate account with its own API key and its own IP whitelist. Sandbox credentials never work against production.

## Rate limits

Namecheap enforces 50 calls per minute, 700 per hour and 8,000 per day across the whole API key. RackHelm is built around that: availability checks are batched up to 30 names per call, a group search sends one bulk call per registrar panel rather than one per TLD, and check results are cached for 3 minutes. Availability calls also use a tighter 8-second timeout with a 3-second connect timeout, so a slow registrar cannot stall a customer's search.

## What Namecheap supports

| Capability | Behaviour |
| --- | --- |
| Registration | `namecheap.domains.create`, sent as a POST because the contact set runs to roughly 60 parameters. One contact block is reused for Registrant, Tech, Admin and AuxBilling. |
| Transfer | `namecheap.domains.transfer.create`. An EPP code is required; codes containing anything other than letters and digits are base64-wrapped automatically. The term is always sent as 1 year, per Namecheap's contract, regardless of the billing cycle. |
| Renewal | Extends by the billing cycle's whole years. |
| Nameservers | Supported from the customer's domain page. |
| Registrar lock | Read and toggle. |
| WHOIS privacy | WhoisGuard. It can only be enabled when a privacy subscription is already attached to the domain — RackHelm reads the WhoisGuard ID and forwards masked WHOIS mail to the registrant email from the order. "Already enabled" counts as success. |
| Availability | Bulk, up to 30 names per call (the API's own hard limit is 50). |
| Domain listing | 100 per page, capped at 200 pages — about 20,000 names — for the domain importer. |
| EPP code | **Not available.** Namecheap exposes no auth-code command. RackHelm unlocks the domain and returns instructions instead. |
| Suspend / unsuspend | Not implemented; domains have no suspend concept. |

### The EPP code gap

When a customer opens the **EPP Code** tab on a Namecheap domain, they do not get a code. They get the domain unlocked (best effort) and a message pointing at **Domain List → Manage → Sharing & Transfer → Transfer Out** in the Namecheap panel, where the code is emailed to the registrant contact. Plan a support process around that if you sell Namecheap TLDs to customers who transfer away often.

### .uk domains

For .uk names the driver sends the registrant's legal type from the customer's address record, defaulting to `IND` when it is not set.

## Troubleshooting

| Symptom | Cause and fix |
| --- | --- |
| Error mentions 1011102 or 1010102 | The API key was rejected, or API access is not enabled on the account. Check both under Profile → Tools → Namecheap API Access. |
| Error mentions 1011150, 1017150 or 1017105 | The calling IP is not whitelisted (or is disabled). Add this server's IPv4 under Edit Whitelisted IPs, and set the panel's **Client IP** if auto-detection is picking the wrong address. |
| Test API shows "Connected, but no balance data returned." | Namecheap answered without a balance block. Usually a permissions problem on the API key. |
| Form rejects the Client IP | Only IPv4 is accepted, because that is all Namecheap accepts. |
| Transfer order fails with "EPP Code is required for transfer." | No code on the order. Make the `EppCode` variable required on transfer products. |
| "Namecheap did not accept the transfer of …" | Namecheap returned success at the envelope level but `Transfer="false"`. Check the domain is unlocked at the losing registrar, is outside its 60-day lock, and that the code is current. |
| Multi-year transfer only bought one year | Expected. Namecheap requires transfers to be one year; renew afterwards for the remaining term. |
| Privacy could not be enabled | There is no WhoisGuard subscription on the domain, or no registrant email is available. Both are logged; add the subscription in the Namecheap panel. |
| Sporadic failures under load | You are hitting the 50-per-minute cap. Reduce how many Namecheap TLDs appear in a searchable group. |