Domain registrar API access tiers
Which registrars expose a public domain API, who gates access by account size, how hard each one throttles, and which offer scoped tokens, OAuth, webhooks or a sandbox — for developers and AI agents that manage domains programmatically.
Short answer
For programmatic domain management, Cloudflare Registrar has the most automation-ready API — the only one in this set with scoped, revocable tokens and a published OpenAPI reference, on a generous 1,200-request / 5-minute account limit. Every registrar here except Squarespace Domains (which has no public API) exposes one, but the access terms differ sharply: GoDaddy is the only registrar that gates production access by account size (its Availability API needs 50+ domains), Dynadot throttles hardest (one concurrent request per account), and only Namecheap, GoDaddy and Dynadot publish a sandbox. None offer OAuth or webhooks.
Facts from Open Domain Data registrar_api_capabilities@2026.06, last checked 2026-06-28.
API access at a glance
Seven registrars, ordered most-open to least-open. “Account gating” is a barrier to getting production access; “rate limit” is the throughput ceiling once you have it.
| Registrar | Tier | Auth | Scoped tokens | Account gating | Rate limit | Sandbox | OpenAPI |
|---|---|---|---|---|---|---|---|
| Cloudflare Registrar | Ungated | API key + scoped API tokens | None | 1,200 requests / 5 min per account | — | reference | |
| Porkbun live-tested | Ungated | API key (key + secret pair) | None | 10 requests / 10s | — | — | |
| Namecheap | Ungated | API key (+ IP allowlist) | None | 20 requests / min per IP | api.sandbox.namecheap.com | — | |
| Spaceship | Ungated | API key | None | Per-endpoint (e.g. 300 requests / 300s per user for DNS record listing) | — | — | |
| Dynadot | Ungated | API key | None | One concurrent request per account | api-sandbox.dynadot.com | — | |
| GoDaddy | Account-gated | API key (key + secret) | Production access to the Availability API requires 50+ domains; the Management and DNS APIs require 1+ domain or a Domain Pro Plan | Documented per endpoint | api.ote-godaddy.com | — | |
| Squarespace Domains | No public API | None — no public domain API | None | n/a — no public domain API | — | — |
None of the registrars in this set support OAuth user delegation or outbound webhooks at dataset version 2026.06.
Ungated
A public API any account can use without an account-size or plan gate.
The most agent-ready API in the set: the only registrar here with scoped, revocable API tokens and a published OpenAPI reference, on a generous account-wide limit. No sandbox — you test against the live account.
A clean REST API open to any account, with a public pricing endpoint that returns data on an unauthenticated request — confirmed live on 2026-06-28. The trade-off is a tight rate limit and no sandbox.
Open to any account and one of the few with a real sandbox, but you must allowlist the calling server's IP before the key works, and the per-IP limit is modest.
A newer API documented per-endpoint rather than with one global ceiling; API-key auth, no sandbox or scoped tokens yet.
Open to any account and offers a sandbox, but the throughput is the tightest in the set: a single concurrent request per account, so high-volume automation has to serialise calls.
Account-gated
A public API whose production access depends on account size or plan tier.
The only registrar in the set that gates production API access by account size: the domain-Availability API is limited to accounts with 50 or more domains, while Management and DNS need at least one domain or a Domain Pro Plan. An OTE sandbox is available for development.
No public API
No public domain API is offered.
No public domain API. Domains registered here are managed only through the Squarespace dashboard, so programmatic or agent-driven management is not possible.
What this means for AI agents
API access is the floor for agent-driven domain management, but it is not the whole picture. An agent also needs least-privilege credentials, approval flows, spend limits and an audit trail — the criteria scored in our Agent Readiness Index. On the access axis specifically, the standout gap is delegation-safety: scoped, revocable tokens exist at exactly one registrar here, and no registrar offers OAuth or webhooks. For the full picks-and-tradeoffs read, see best domain registrars for domain APIs and best domain registrars for AI agents.
Frequently asked questions
Which domain registrar has the best API for automation and AI agents?+
Which registrars require a minimum number of domains to use their API?+
Do any domain registrars offer scoped API tokens or OAuth?+
Which registrars provide a sandbox or test environment for their API?+
Where does this API data come from?+
Data source & coverage
Every API fact on this page mirrors the neutral registrar_api_capabilities dataset (version 2026.06) from Open Domain Data, compiled from each registrar's own documentation and last checked 2026-06-28. Open Domain Data publishes the neutral facts; this page adds the access-tier interpretation. The raw records are available as JSON.
Coverage note: this page reflects the seven registrars in the Open Domain Data API dataset. NameSilo is on this site but does not yet have a verified API record in that dataset, so it is omitted here rather than guessed; it is queued for the next dataset release.
Sources
- https://api.porkbun.com/api/json/v3/pricing/get
- https://developer.godaddy.com/doc/endpoint/domains
- https://developer.godaddy.com/getstarted
- https://developers.cloudflare.com/api/
- https://developers.cloudflare.com/fundamentals/api/get-started/create-token/
- https://developers.cloudflare.com/fundamentals/api/reference/limits/
- https://developers.cloudflare.com/registrar/
- https://docs.spaceship.dev/
- https://porkbun.com/api/json/v3/documentation
- https://support.squarespace.com/hc/en-us/sections/360001172391-Domains
- https://www.dynadot.com/domain/api
- https://www.namecheap.com/support/api/intro/