Namecheap DNS
Namecheap's API is different from a typical REST: it uses an API user + API key pair, plus a required client IP allowlist on Namecheap's side. You have to whitelist the egress IP of your CertAutoPilot backend before any call will succeed.
Namecheap gates API access on account tier: minimum 20 domains, or $50+ spend in the last year, or $50 account balance, or two years of customer history. The enable-API toggle is in your profile. Verify before wiring CertAutoPilot up.
Enable the API
- Log in at namecheap.com.
- Profile → Tools → Business & Dev Tools → API Access → toggle on.
- In the same page, find Whitelisted IPs and add the egress IP of your CertAutoPilot backend (pod IP in K8s is volatile — use the NAT IP of your cluster's egress).
- Copy the API Key shown at the top.
- API user is your Namecheap login username.
Add the credential
- Settings → DNS Credentials → New → Namecheap.
- API user: Namecheap username.
- API key: paste.
- Client IP: the egress IP you whitelisted. If left blank, lego auto-detects the egress IP by calling an external IP-echo service when the provider is created. That address still has to match Namecheap's allowlist, and the detection call fails on a host with no outbound HTTP — set the IP explicitly in production.
- Sandbox: leave OFF for production. Turn ON only to exercise the API against the separate sandbox environment with a sandbox-issued API key.
- Test connectivity → Save.
Config fields
| Field | Required | Purpose |
|---|---|---|
api_user | yes | Namecheap username. |
api_key | yes | API key from the profile page. |
client_ip | recommended | The whitelisted backend egress IP. |
sandbox | no | Use Namecheap's sandbox endpoint (api.sandbox.namecheap.com) instead of production. |
Propagation
Namecheap propagation is slow-ish — plan for 30–120 seconds. Slow propagation is absorbed by the phased flow's propagation gate — if issuance times out, raise DNS Propagation Deadline under Settings → General (default 1800 s, range 300–14400).
Troubleshooting
"API Key is invalid or API access has not been enabled"
Most common cause: the client IP isn't on the Namecheap whitelist. Double-check Namecheap's Manage API Access page. If your backend IP is dynamic, contact Namecheap to broaden the allowlist.
"Requested option is not supported"
Usually means the domain is registered elsewhere and just uses Namecheap's DNS (or vice-versa). The Namecheap API only modifies zones on domains actively registered at Namecheap.
Sandbox returns stale zone state
Sandbox is a separate system; production changes don't propagate to it. Use separate credentials for sandbox and production.