# Domain reseller APIs compared: what developers should check (https://app.resellerhq.com/blog/domain-reseller-api-comparison)
By ResellerHQ. Published 2026-10-07, updated 2026-10-29.
Most domain reseller APIs can register and renew a name; they differ in how safely you can retry a paid call, how you learn about slow events such as transfers, how hard they throttle you, and how closely the test environment matches production. As of October 2026, Name.com and Openprovider document modern REST APIs, OpenSRS is XML, CentralNic Reseller offers EPP among several gateways, and published rate limits range from 50 requests a minute to 100 a second. Check idempotency, webhooks, rate limits and sandbox behaviour in each vendor's own docs before you compare prices.
Domain reseller APIs all register and renew names. Where they differ is in what happens when something goes wrong: whether a timed-out purchase can be retried safely, how you find out a transfer finished, how quickly you get throttled, and whether the test environment behaves like production. Those four things decide how much code you write around the API, so check them before you compare wholesale prices.
This article reports what the public documentation of nine domain reseller APIs says as of October 2026. Existing comparisons tend to stop earlier. [Openprovider's own comparison](https://www.openprovider.com/blog/domain-reseller-api) of five APIs has a summary table covering protocol, OpenAPI spec, TLD count, sandbox, WHMCS support and pricing model. It names webhook support as a criterion, but the table has no column for rate limits, idempotency or webhooks.
## The short comparison [#the-short-comparison]
The nine APIs fall into three groups: documented REST with JSON, older HTTP APIs that take a key in the query string, and multi-protocol platforms that include XML or EPP.
| API | Style | Authentication | Test environment | Published rate limit | Webhooks | Idempotency key |
| ------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Name.com | REST, JSON, [OpenAPI 3.1 spec](https://docs.name.com/) | [HTTP Basic, username and token](https://docs.name.com/guides/authentication.md) | [Separate host, api.dev.name.com](https://docs.name.com/guides/testing-environment.md) | [20 per second, 3,000 per hour (v4 docs)](https://www.name.com/api-docs) | [Yes, signed](https://docs.name.com/api/v1/reference/webhook-notifications/overview.md) | Not found; [ETag and If-Match](https://www.name.com/api-docs) instead |
| Openprovider | [REST, JSON, OpenAPI](https://developer.openprovider.com/) | [Bearer token from a login call](https://developer.openprovider.com/) | [Separate sandbox account](https://developer.openprovider.com/) | [300 identical calls per 300 seconds; 15 identical domain creations per 300 seconds](https://support.openprovider.eu/hc/en-us/articles/218390187-What-are-Openprovider-API-calls-limits) | Not found | Not found |
| OpenSRS | [XML for domains, JSON for email](https://opensrs.com/api/overview) | [MD5 signature in headers](https://opensrs.com/api/overview) | [Separate test host](https://opensrs.com/api/overview) | Not found | Not found | Not found |
| Enom | [Query string or POST, 300+ commands](https://www.enom.com/reseller/api/) | Not found on the page opened | [Yes](https://www.enom.com/reseller/api/) | Not found | Not found | Not found |
| CentralNic Reseller | [EPP, XRRP, HTTPS, SOAP, XML-RPC, SMTP](https://www.centralnicreseller.com/api/) | Not found on the page opened | [OT\&E system](https://www.centralnicreseller.com/api/) | Not found | Not found | Not found |
| Namecheap | Not confirmed; the API introduction page refused our request | [Key plus whitelisted IPv4 address](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/) | [Separate sandbox](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/) | [50 per minute, 700 per hour, 8,000 per day](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/) | Not found | Not found |
| Dynadot | [XML or JSON over HTTP](https://www.dynadot.com/domain/api-commands) | [Key in the query string](https://www.dynadot.com/domain/api-commands) | [Separate sandbox host](https://www.dynadot.com/domain/api-commands) | [60 per minute regular, up to 6,000 per minute super bulk](https://www.dynadot.com/domain/api-commands) | Not found | Not found |
| NameSilo | [GET only, XML or JSON](https://www.namesilo.com/api-reference) | [Key in the query string](https://www.namesilo.com/api-reference) | [On request](https://www.namesilo.com/api-reference) | Not found | Not found | Not found |
| GoDaddy | [REST, JSON](https://developer.godaddy.com/getstarted) | [Bearer personal access token](https://developer.godaddy.com/getstarted) | [None mentioned; the guide says all requests go to production](https://developer.godaddy.com/getstarted) | [600 per window of about 23 minutes](https://developer.godaddy.com/llms.mdx/api-users/rate-limits) | Not found | [Header on writes "where supported"](https://developer.godaddy.com/llms.mdx/api-users/domains/workflows/api-integration) |
*name.com documents its Core API and offers an OpenAPI specification to download. Screenshot of [docs.name.com](https://docs.name.com/), taken on 7 October 2026.*
Every cell was read on 7 October 2026 from the page linked in it. "Not found" means the pages we opened did not mention it, not that the feature is absent. Name.com's rate limit and ETag figures come from its v4 documentation; the index of its newer Core API docs lists no page on rate limits. ResellerClub is left out of the table because its platform and knowledge base pages returned HTTP 403 to our requests on 7 October 2026, so we could not confirm what its API documentation says. If you are weighing it, see [ResellerClub alternatives](/blog/resellerclub-alternatives).
## REST, XML or EPP [#rest-xml-or-epp]
REST with JSON is the right default for a reseller, and EPP is only worth it if you already know why you need it.
**EPP** is the protocol registrars use to talk to registries. [RFC 5730](https://www.rfc-editor.org/rfc/rfc5730.txt), published in August 2009 as Internet Standard 69, describes it as "an application-layer client-server protocol for the provisioning and management of objects stored in a shared central repository". It is XML, it is session-based, and it has five commands that change an object: create, delete, renew, transfer and update. It also has a `poll` command, "used to discover and retrieve service messages queued by a server for individual clients", which is how a client learns about things like a completed transfer. There are no webhooks in EPP. A reseller rarely needs it, but [CentralNic Reseller offers an EPP gateway](https://www.centralnicreseller.com/api/) and states compliance with RFC 3735 and RFC 5730 to 5734, which suits teams that already have EPP tooling.
**XML and query-string APIs** are the older generation of reseller API. OpenSRS describes its domains API as ["XML-based"](https://opensrs.com/api/overview), Enom tells you to ["set up your query string or post"](https://www.enom.com/reseller/api/), and NameSilo states that ["all operations MUST be invoked via GET method"](https://www.namesilo.com/api-reference). The cost is in your code: you parse XML, and with GET-only APIs your key travels in the URL, where it can end up in logs.
**REST with JSON** is what Name.com, Openprovider and GoDaddy document today. Name.com publishes an [OpenAPI 3.1 specification](https://docs.name.com/) and Openprovider says you can ["generate a typed client in any language directly from our schema"](https://developer.openprovider.com/). A machine-readable spec matters more than the protocol label, because you can generate a client from it. Check version lifetimes too: Openprovider's [docs say](https://docs.openprovider.com/doc/all) integrations on the older `/v1beta` endpoints must move to `/v1` before 30 June 2027.
*Openprovider describes its API as one OpenAPI-compliant REST API. Screenshot of [developer.openprovider.com](https://developer.openprovider.com/), taken on 7 October 2026.*
## Authentication and network restrictions [#authentication-and-network-restrictions]
Authentication ranges from a bearer token to a signed request from an allowlisted IP address, and the stricter schemes add deployment work. Check three things.
* **Where the secret travels.** A header is better than a query string. Dynadot and NameSilo pass the [key in the URL](https://www.dynadot.com/domain/api-commands); GoDaddy uses a [bearer token in the Authorization header](https://developer.godaddy.com/getstarted); OpenSRS uses an [MD5 signature sent in headers](https://opensrs.com/api/overview).
* **Whether tokens expire.** Openprovider issues a bearer token from a login endpoint, and its support site says the token is [valid for 2 days](https://support.openprovider.eu/hc/en-us/articles/360013974800-How-long-API-Bearer-Auth-token-is-valid-for) (article last updated 2 February 2024). You need refresh logic, and token generation is itself limited to [30 calls per 60 seconds](https://support.openprovider.eu/hc/en-us/articles/218390187-What-are-Openprovider-API-calls-limits).
* **Whether your IP must be allowlisted.** Namecheap requires you to ["whitelist at least one IP"](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/) and accepts only IPv4. The quickstart code on the [OpenSRS API page](https://opensrs.com/api/overview) marks the live host as "IP whitelisting required" and the test host as not requiring it. Allowlisting is awkward on hosting without a fixed outbound address.
Also check whether you qualify for API access at all. Namecheap enables it only if the account has [at least 20 domains, a $50 balance, or $50 spent in the last two years](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/).
## Test environments [#test-environments]
A sandbox is only useful if it tells you how it differs from production, and the vendors vary a lot here. Eight of the nine document some test environment. GoDaddy's current guide is the exception: it says [all requests go to production](https://developer.godaddy.com/getstarted).
Name.com's testing guide is the most candid of those we read. The sandbox is a [separate host with a "-test" username, and accounts are provisioned with $100,000 of test credit](https://docs.name.com/guides/testing-environment.md). The same page lists the limits: DNS changes do not resolve publicly, transfer outcomes are not deterministic, domains cannot be deleted once created, and many behaviours come from each registry's own test environment and may not match production.
A sandbox confirms your request format and error handling, not registry-specific behaviour. Namecheap notes that names registered for real ["will be shown as available in the Sandbox"](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/). Before you trust a sandbox, ask:
1. Can I get credentials without talking to sales? NameSilo's is [on request](https://www.namesilo.com/api-reference).
2. Can I force each failure: taken name, insufficient balance, unsupported ending?
3. Do webhooks or poll messages fire in the sandbox?
## Idempotency and safe retries [#idempotency-and-safe-retries]
Almost none of the domain reseller APIs we read document an idempotency key, which means a timed-out registration is your problem to resolve. This is the largest gap in the category.
The risk is simple. You send a paid `register` call, the connection drops, and you do not know whether the name was bought. An idempotency key fixes this: the client sends a unique value with the request, and the server returns the stored result if the same value arrives again. The pattern is described in an [IETF draft](https://www.ietf.org/archive/id/draft-ietf-httpapi-idempotency-key-header-07.html), which the [IETF Datatracker lists as expired and archived](https://datatracker.ietf.org/doc/draft-ietf-httpapi-idempotency-key-header/) as of October 2026, so it is a convention and not a standard. Stripe is the usual reference implementation: it stores the first result for a key and lets keys be pruned once they are [at least 24 hours old](https://docs.stripe.com/api/idempotent_requests).
What the domain APIs offer instead:
* **GoDaddy** says write operations use an [Idempotency-Key header "where supported"](https://developer.godaddy.com/llms.mdx/api-users/domains/workflows/api-integration). Confirm which endpoints before relying on it.
* **Name.com** provides [ETag headers and If-Match](https://www.name.com/api-docs), which stop you overwriting a record that changed. That is concurrency control, not retry safety for a purchase.
* **EPP** has an optional client transaction identifier, which [RFC 5730](https://www.rfc-editor.org/rfc/rfc5730.txt) says "MAY be used to uniquely identify the command to the client". It is for tracing; the RFC does not describe it as duplicate detection.
Where there is no key, the safe pattern is read-before-retry: after a timeout, look the domain up in your account, and only resend if it is not there. Domain registration has one natural safeguard, because a name can only be registered once. Renewals do not: two renew calls add two years. Our guide to [idempotency keys and webhooks for reseller APIs](/blog/idempotency-keys-and-webhooks-for-reseller-apis) covers the pattern in detail.
## Webhooks versus polling [#webhooks-versus-polling]
Only Name.com clearly documents signed webhooks among the APIs we read; with most of the others, plan to poll. This matters because some domain operations, transfers above all, do not finish within one request.
Name.com lets you subscribe a callback URL to named events, gives `domain.transfer.status_change` as an example, and signs every request with an [X-NAMECOM-SIGNATURE header](https://docs.name.com/api/v1/reference/webhook-notifications/overview.md) that you verify with HMAC. The overview page we read does not state a retry policy, so ask what happens if your endpoint is down.
Compare any vendor's webhooks against the [Standard Webhooks specification](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md): the signature should cover a message ID and timestamp as well as the body, retries should span days with backoff, and each delivery should carry a stable ID for dropping duplicates.
If there are no webhooks, budget your polling against the rate limit.
## Rate limits [#rate-limits]
Published rate limits differ by a factor of more than 100, and the low ones change how you design bulk operations. As of October 2026:
* **Namecheap:** [50 per minute, 700 per hour and 8,000 per day](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/) across the whole key.
* **Dynadot:** tied to account spend, from [60 per minute on a regular account to 6,000 per minute on super bulk](https://www.dynadot.com/domain/api-commands).
* **Openprovider:** per call type, and the limits apply to identical calls. Identical calls in general are limited to [300 per 300 seconds, identical availability checks to 20 per 300 seconds and identical domain creations to 15 per 300 seconds](https://support.openprovider.eu/hc/en-us/articles/218390187-What-are-Openprovider-API-calls-limits) (article last updated 16 July 2025). Exceeding the creation limit blocks API access for 300 seconds, and exceeding the general limit returns "Access denied" until the block is removed manually. The page says Openprovider cannot raise the limits.
* **Name.com:** [20 requests per second or 3,000 per hour](https://www.name.com/api-docs) in its v4 documentation, with an HTTP 429 when exceeded.
* **GoDaddy:** [600 per window of about 23 minutes](https://developer.godaddy.com/llms.mdx/api-users/rate-limits), with `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` headers on every response. GoDaddy warns that the values can change without notice and tells you to read the headers.
Prefer an API that reports remaining quota in headers and returns a clean 429, so your client can back off without hard-coded numbers.
These limits matter most once you move past single lookups to buying several names at once. See [how to register domains in bulk through an API](/blog/how-to-register-domains-in-bulk-through-an-api) for the checking-versus-registering workflow and why a bulk registration is sent as one idempotent request per domain rather than one call for the whole batch.
## Where ResellerHQ fits [#where-resellerhq-fits]
ResellerHQ is not yet an option for live domain registration, and it should not be on your shortlist for that today. Domains run in the sandbox only; on the live side the domain routes answer `422 not_available`. Hosted DNS, transfers in and automatic renewal from the wallet are built and can be tried in the sandbox, under the same limit. Starting prices are on the [home page](/#pricing), and the exact price shows in the dashboard and from the API before you order.
What exists is the API contract, which you can test in the sandbox. It is REST with a bearer key, where `rhq_test_` keys reach the sandbox and `rhq_live_` keys reach the live side. Register and renew accept an `Idempotency-Key` header with results stored for 24 hours, a reused key with a different body answers 422, and an in-flight duplicate answers 409. Events such as `domain.registered` and `domain.renewed` are delivered as signed webhooks that follow Standard Webhooks, and the limit is 300 requests a minute per key. Sandbox domains are not registered anywhere. The [docs](/docs) have the details.
If you need live domains now, pick from the table above. For how these platforms differ commercially, see [what a white-label reseller platform is](/blog/what-is-a-white-label-reseller-platform).
## Checklist before you integrate [#checklist-before-you-integrate]
Run through this list against the vendor's own documentation, not its marketing page.
1. **Spec.** Is there an OpenAPI document you can generate a client from?
2. **Protocol.** REST with JSON, or will you be parsing XML or holding EPP sessions?
3. **Secrets.** Does the key travel in a header? Do tokens expire, and how do you refresh them?
4. **Network.** Is IP allowlisting required, and does your hosting give you a fixed address?
5. **Access.** Are there balance, spend or domain-count requirements before the API is switched on?
6. **Sandbox.** Can you get keys yourself? Does the vendor document how the sandbox differs from production?
7. **Failure cases.** Can you trigger taken, unsupported and insufficient-funds responses on demand?
8. **Retries.** Is there an idempotency key on register, renew and transfer? If not, write read-before-retry logic.
9. **Charging.** Is your balance debited only when the registration succeeds, and how is a failed order refunded?
10. **Async events.** Webhooks or polling for transfers and expiry? If webhooks: signed, retried, deduplicable?
11. **Rate limits.** What are the numbers per endpoint, are they in response headers, and is there a bulk availability check?
12. **Errors.** Are error codes stable strings you can branch on, with a request ID for support?
13. **Deprecation.** Is the API version you are building on scheduled for retirement?
## Frequently asked questions
### What is the best domain reseller API?
There is no single best one. Name.com and Openprovider document REST APIs with an OpenAPI spec, CentralNic Reseller lists EPP and SOAP among its gateways, and OpenSRS and Enom document XML and query-string APIs. Pick by retry safety, webhooks, rate limits and test environment, then by price.
### Do I need to be an ICANN-accredited registrar to use a domain reseller API?
No. A reseller API lets you register names through a company that is already accredited, so you call their API instead of talking to each registry yourself. You would need accreditation only to connect to registries directly.
### Should I use REST or EPP to resell domains?
Use REST unless you have a specific reason not to. EPP is the XML protocol registrars use to talk to registries; it is session-based and standardised in RFC 5730, but most resellers never need it. CentralNic Reseller is one platform that exposes EPP to resellers.
### Which domain reseller APIs have a sandbox?
Name.com, Openprovider, OpenSRS, Namecheap, Dynadot, Enom and CentralNic Reseller all document a test environment, and NameSilo provides one on request. GoDaddy's current getting-started guide says all requests go to production.
### Do domain reseller APIs support idempotency keys?
Rarely, in the documentation we opened. GoDaddy's integration guide mentions an Idempotency-Key header on write operations where supported, and Name.com documents ETag and If-Match for conditional updates. For the others we found no documented idempotency key, so you have to check for an existing order before retrying.
### What are typical rate limits on a domain reseller API?
They vary by two orders of magnitude. As of October 2026 Namecheap documents 50 requests a minute, Dynadot 60 a minute on a regular account, Openprovider 15 identical domain creations per 300 seconds, and Name.com 20 requests a second with a cap of 3,000 an hour.
## Sources
- [RFC Editor: RFC 5730, Extensible Provisioning Protocol (EPP)](https://www.rfc-editor.org/rfc/rfc5730.txt)
- [Name.com: API documentation (v4)](https://www.name.com/api-docs)
- [Name.com: Core API documentation](https://docs.name.com/)
- [Name.com: Authentication guide](https://docs.name.com/guides/authentication.md)
- [Name.com: Testing environment guide](https://docs.name.com/guides/testing-environment.md)
- [Name.com: Webhook notifications overview](https://docs.name.com/api/v1/reference/webhook-notifications/overview.md)
- [Openprovider: REST API developer portal](https://developer.openprovider.com/)
- [Openprovider: What are Openprovider API calls limits?](https://support.openprovider.eu/hc/en-us/articles/218390187-What-are-Openprovider-API-calls-limits)
- [Openprovider: How long API Bearer Auth token is valid for?](https://support.openprovider.eu/hc/en-us/articles/360013974800-How-long-API-Bearer-Auth-token-is-valid-for)
- [Openprovider: API documentation and v1beta migration notice](https://docs.openprovider.com/doc/all)
- [Openprovider: 5 best domain reseller APIs](https://www.openprovider.com/blog/domain-reseller-api)
- [OpenSRS: API overview](https://opensrs.com/api/overview)
- [Enom: Reseller API](https://www.enom.com/reseller/api/)
- [CentralNic Reseller: API](https://www.centralnicreseller.com/api/)
- [Namecheap: API FAQ](https://www.namecheap.com/support/knowledgebase/article.aspx/9739/63/api-faq/)
- [Dynadot: API commands](https://www.dynadot.com/domain/api-commands)
- [NameSilo: API reference](https://www.namesilo.com/api-reference)
- [GoDaddy: Get started with the developer platform](https://developer.godaddy.com/getstarted)
- [GoDaddy: Handle rate limits](https://developer.godaddy.com/llms.mdx/api-users/rate-limits)
- [GoDaddy: How to build an API integration](https://developer.godaddy.com/llms.mdx/api-users/domains/workflows/api-integration)
- [IETF: The Idempotency-Key HTTP Header Field (draft 07)](https://www.ietf.org/archive/id/draft-ietf-httpapi-idempotency-key-header-07.html)
- [IETF Datatracker: draft-ietf-httpapi-idempotency-key-header](https://datatracker.ietf.org/doc/draft-ietf-httpapi-idempotency-key-header/)
- [Stripe: Idempotent requests](https://docs.stripe.com/api/idempotent_requests)
- [Standard Webhooks: Specification](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md)