Module and release scope
This guide covers Namecheap Registrar 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Domain registrars (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
environment — Environment |
select | Yes | Default: "sandbox" Choices: sandbox = Sandbox, live = Live |
api_user — API username |
text | Yes | Use the account-specific value described below. |
api_key — API key |
secret | Yes | Use the account-specific value described below. |
username — Account username |
text | Yes | Use the account-specific value described below. |
client_ip — Whitelisted server IPv4 |
text | Yes | Use the account-specific value described below. |
allow_writes — Allow domain purchases and changes |
boolean | No | Default: false |
allow_automated_renewals — Allow paid-invoice automated renewals |
boolean | No | Default: false |
Install this package, enable the module, create a registrar connection, save credentials and run Test. Packages and connections are separate: installation leaves this module disabled. Purchases and changes remain disabled until Allow domain purchases and changes is selected. Start in the Namecheap sandbox with separate sandbox credentials and no real funds.
API access
In Namecheap, enable API access under Profile → Tools → Business & Dev Tools → API Access. Production API eligibility is controlled by Namecheap; request approval if your account does not qualify. Whitelist the installation server's public IPv4 address. Enter API username, API key, account username and that same IPv4 in the connection. The key is encrypted by the product. Keep sufficient Namecheap account funds for purchases. The account test reads namecheap.users.getBalances; it never registers a domain.
Fixed endpoints are https://api.sandbox.namecheap.com/xml.response and https://api.namecheap.com/xml.response. Requests use HTTPS POST form data, bounded timeouts and response size, no redirects and no automatic retry. No webhook is required; use domain synchronization for readback.
Operations
Supported: exact availability (domains.check); registration (domains.create); transfer (domains.transfer.create); renewal (domains.renew); domain information and synchronization (domains.getInfo); custom nameservers (domains.dns.setCustom); lock and unlock (domains.setRegistrarLock). Registration confirmation also reads domains.getContacts to verify the intended registrant. EPP retrieval and contact editing are performed in the Namecheap dashboard because this package does not advertise undocumented API methods.
Registration sends the actual domain customer's canonical contact to registrant, administrator, technical and billing roles. Required fields are first and last name, email, address, city, state, postcode, ISO country and international phone. An account-owner contact is never substituted for missing customer data. At least two distinct nameservers and an integer term from 1 to 10 are required; registry-specific terms and eligibility still apply. IDN language attributes and restricted-TLD eligibility require registrar review; the module does not fabricate them. Registry premium registrations and renewals are held for manual review.
The Namecheap transfer API accepts one year and only its documented extensions: .biz, .ca, .cc, .co, .com, .com.es, .com.pe, .es, .in, .info, .me, .mobi, .net, .net.pe, .nom.es, .org, .org.es, .org.pe, .pe, .tv and .us. Supply auth_code in the domain tool's optional provider options; it is sent with the documented Base64 prefix. Transfer submission preserves the remote contact/DNS behavior of Namecheap's API; use synchronization and review after completion.
Confirmation and recovery
An accepted transfer or non-real-time registration stays pending. Registration requires a fresh owned-domain record, valid registry expiry covering the requested term, and matching contact and nameservers before activation. Renewals read the current remote expiry before dispatch and confirm that it covers the full purchased term afterward. A changed local expiry blocks the request. Automated renewal needs both write permission and the separate automated-renewal option.
If a purchase times out or the response cannot be confirmed, review the Namecheap account and synchronize the domain before retrying. The product records submitted uncertainty and prevents a second automatic purchase. Diagnostics retain safe provider codes and messages without credentials, contact details or transfer codes. Never put credentials, customer contacts or production connection data in a package.