If your script only needs to look up domain names and prices, Vercel now lets you do that without storing an API token. On 2026-09-28, it published a changelog entry titled “Search domains without authentication”: its Domains Registrar API checks up to 200 exact domain names in one request, returning registerable status plus registration and renewal prices.
That removes the credential-storage problem for a script, CLI, or agent tool, but only for names you would buy at Vercel’s registrar. RDAP, the standardized WHOIS successor, remains the vendor-neutral alternative that returns status with no prices at all.
What changed on 2026-09-28
The Vercel changelog describes the lookup: “With the Domains Registrar API, check up to 200 exact domain names in one request. The response shows whether each can be registered and, when available, its registration and renewal prices:” The entry also states: “Authentication is still required to buy or manage domains.” Read-only lookups are anonymous; buying or managing a domain still needs authentication.
For a developer adding a check to CI or an LLM agent’s tool list, the useful change is less work around secrets. A read-only “is this name taken?” lookup no longer needs a Vercel token stored in that tool. We covered another cost-data integration in Vercel’s Billing Usage API; this domain-search change is specifically about the unauthenticated lookup path.
Check two things before shipping against this endpoint: the rate limit on unauthenticated requests, and which TLDs it covers. The changelog says nothing about either. Silence in a vendor announcement is not a guarantee of no limits; both remain [unverified] until the API documentation is checked.
What the Vercel response actually gives you
The changelog describes two parts of the response. First, a per-name registerable flag: an explicit answer to “can this be registered,” not an inference you draw from an HTTP status code. Second, registration and renewal prices “when available.” That qualifier matters when you build the tool: prices are not guaranteed for every name in the batch, and the changelog does not explain when pricing is absent. Decide how to handle a missing price rather than assume every result has one.
Read the answer within the registrar’s limits. “Can be registered” from Vercel’s Domains Registrar API means can be registered through Vercel’s registrar, at the price Vercel quotes. It does not establish that the name is unavailable elsewhere or that another registrar would quote the same number. Keep that scope visible in your tool so a registrar’s answer does not become a universal claim about the name.
The renewal price deserves space beside the registration price. They are separate figures, and renewal is the cost that keeps coming back. There is also a term to account for: per Hostinger’s domain search page, the minimum registration period is one year, but some TLDs such as .ai require a two-year minimum. A returned price is registrar-specific and term-specific. If a comparison tool leaves out the term, the reader still cannot tell what that price commits them to.
The RDAP baseline: status, no prices, no token ever
RDAP (Registration Data Access Protocol) is the standards-based successor to WHOIS. As one community walkthrough describes it, RDAP replaces WHOIS’s free-text responses with standardized JSON returned over HTTP/HTTPS as a RESTful API. The same source notes PSI-Japan has operated an RDAP lookup service since 2019-08-26, providing a deployment example. For a new integration, check the registry’s supported RDAP path rather than assume WHOIS remains the required interface.
Three properties define RDAP as the comparison path here. It is an open standard, not a vendor endpoint. It requires no credentials for the queries at issue. And it carries no pricing data whatsoever; registration data, not retail data, is the protocol’s domain.
Coverage is the bound. Per client.rdap.org, “All generic TLDs now support RDAP, but only a few ccTLDs have deployed RDAP so far.” For .com, .net, and other gTLDs, that gives you an RDAP status path. Country-code TLDs still need a per-TLD support check. ICANN’s compliance deadline for STD 95 and the 2024 gTLD RDAP Profile, 21 August 2025, binds gTLD contracted parties, according to the second community walkthrough. The same source places ccTLDs outside that mandate, so the deadline is not evidence that their coverage gap will close.
Availability semantics: explicit flag vs 404 inference
This is where a small parsing shortcut can give your user the wrong answer.
Vercel’s endpoint answers the question directly. The response tells you whether each name can be registered. Your code reads a field.
RDAP has no “available” field. Availability is inferred, as one zenn.dev walkthrough shows: query the registry’s RDAP server for the domain object, and if you get a registration record back, the domain exists and is taken; if you get an HTTP 404, the object does not exist, which usually means the name is free. “Usually” is doing real work in that sentence. The same zenn.dev walkthrough documents a live counterexample: on 2026-05-28, GMO Internet’s Onamae RDAP server answered a query for kobedenshi.ac.jp with a 404 whose error body read “Onamae does not support forward domain queries.” That 404 says the server declined the query type. It says nothing about whether the domain is registered.
The practical rule for any RDAP-based availability check: never map 404 to “available” without inspecting the error body. A 404 with an empty or not-found description on a supported query is evidence of availability; a 404 with an unsupported-operation description is no evidence at all. Code that treats the status code alone as the signal will silently misreport names in exactly the ccTLD space where RDAP coverage is already thin.
Privacy, batching, and what each query reveals
If you are checking names for an unannounced product, who sees the lookup matters. client.rdap.org connects your browser directly to the relevant registry’s RDAP server over HTTPS. Per the tool’s own description, the sponsoring registrar may also see the query if you enable referral-following and the registry supplies a referral. A vendor-API lookup discloses the checked names to that vendor. A self-run RDAP client can also query registries directly, but check its referral behavior rather than assume every client follows the same privacy path.
Batching cuts the other way. Per the changelog, Vercel checks up to 200 exact names per request. RDAP is one object per lookup, so a 200-name sweep is 200 requests against however many different registry servers your TLD mix touches, each with its own behavior. For bulk screening, the vendor endpoint is structurally more convenient; for a single sensitive name, the neutral path reveals less.
Decision table
| Axis | Vercel Domains Registrar API (unauthenticated search) | RDAP |
|---|---|---|
| Auth for lookup | None, per the 2026-09-28 changelog | None |
| Auth for purchase/manage | Still required | n/a (not a purchase channel) |
| Availability signal | Explicit per-name registerable flag | Inferred: record vs 404, error body must be inspected |
| Pricing | Registration and renewal prices “when available” | None |
| Batch size | Up to 200 exact names per request | One object per lookup |
| TLD coverage | Unstated in changelog [unverified] | All gTLDs; few ccTLDs |
| Rate limits | Unstated in changelog [unverified] | Not documented in the sources cited; check each registry |
| Query privacy | Vercel sees every checked name | Registry sees the query; registrar may see it if a supplied referral is followed |
| Durability | Coupled to Vercel’s registrar and pricing | Open standard (STD 95, 2024 gTLD RDAP Profile) |
Which to wire in, and what to check first
I would choose Vercel’s unauthenticated search when the tool needs to screen names in bulk with prices attached. For example, an agent might propose ten name candidates and rank them by cost, or a CI step might validate a list. Vercel answers that in one call without the credential work. Accept that the answer is scoped to Vercel’s registrar, show registration and renewal separately with their terms, and treat the coupling as a chosen dependency.
If your tool needs a vendor-neutral “does this registration exist” check without a pricing lookup, RDAP is a useful foundation. Inspect the error body before inferring availability from a 404 and verify support for each ccTLD in scope. Many tools may use both: RDAP for status and a vendor endpoint for prices, without assuming those signals are interchangeable.
Before shipping against the Vercel path, verify its unauthenticated rate limit and supported TLD list. Both remain outstanding as of this writing; neither appears in the changelog and neither should be assumed. Both paths also qualify their “available” signal: Vercel’s answer is registrar-scoped, while RDAP’s is an inference with a documented failure mode. Whichever you pick, check those limits before the tool tells someone a name is free.
Join the discussion
Share a useful perspective or ask a question about this article.