What is a domain authorization (EPP) code and where do you find it?

A domain authorization code, also called an EPP code, auth code, transfer key or AuthInfo code, is a unique password attached to a domain name that proves the person requesting a registrar transfer is authorised to move it. The gaining registrar sends the code to the registry with the transfer request, and the registry only accepts the request if the code matches. You find it in your current registrar's dashboard, usually on the domain's settings page under a label such as Transfer, Auth Code or Get EPP Code, or the registrar emails it to your registrant address when you request it.

The code is a small detail, but a wrong, expired or missing one is one of the most common reasons transfers stall. This article explains what the code is and where it comes from, where to find it at typical registrars, how it's used during a transfer, how to keep it secure, and what to do when the code doesn't work.

What an Auth Code Actually Is

Generic top-level domains are managed by registries using EPP (Extensible Provisioning Protocol). Every domain object in an EPP registry can carry an authInfo value: a password set by the sponsoring registrar. When another registrar wants to take over sponsorship of the domain, it must supply that password.

In EPP terms, a gaining registrar's transfer request looks roughly like this:

<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
  <command>
    <transfer op="request">
      <domain:transfer xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
        <domain:name>example.com</domain:name>
        <domain:period unit="y">1</domain:period>
        <domain:authInfo>
          <domain:pw>Xk9#qT2v!mR7pLs4</domain:pw>
        </domain:authInfo>
      </domain:transfer>
    </transfer>
    <clTRID>ABC-12345</clTRID>
  </command>
</epp>

You'll never write this yourself. Registrars handle EPP behind the scenes. But it shows what the code is for: it's the shared secret that the registry checks before it allows the domain to change hands between registrars.

The Different Names

You'll see the same thing called different names depending on the registrar or registry:

Name	Where you'll see it
EPP code	Many registrars, after the protocol name
Auth code or authorization code	Most common in registrar dashboards
AuthInfo code	Technical documentation and some European registries
Transfer key or transfer secret	Some registrars' interfaces
Transfer Authorization Code (TAC)	ICANN's updated Transfer Policy

They all refer to the same password.

How It's Changing Under ICANN's Updated Policy

ICANN's updated Transfer Policy formalises how the code should be handled, using the name Transfer Authorization Code (TAC). The main ideas are that the code should be generated only when the registrant asks for it, should be random and strong, should be valid for a limited period (14 days under the new rules), and should be stored securely rather than displayed permanently. Registrars are moving to these rules over time, which is why some now generate a fresh code on request and others still show a long-lived code in the dashboard. Either way, the code you use is whatever your current registrar gives you at the time of the transfer.

Where to Find Your Auth Code

The exact menu differs between registrars, but the code is almost always in one of these places.

In the Domain's Settings Page

1. Log in to the registrar account where the domain is registered.
2. Open Domains or Domain List and select the domain.
3. Look for a Transfer, Transfer out, Advanced or Security section.
4. Click Get auth code, Show EPP code or similar.

Some registrars display the code straight away. Others ask you to confirm with two-factor authentication first.

By Email

Many registrars email the code to the registrant email rather than showing it on screen. This adds a check that the request comes from the domain's actual owner. If you don't receive it:

• Check your spam folder.
• Confirm the registrant email on the domain is correct and still working.
• Make sure the email address isn't on the same domain if that domain's mail is currently broken.

From Support

A few registrars, and some resellers, require you to contact support to receive the code. That's legitimate, but under ICANN rules the registrar must provide the code to the registrant within a short period, typically five calendar days. Registrars can't hold it back to keep you from leaving.

If You Don't Know Your Registrar

If you're not sure where the domain is registered, look it up. RDAP shows the sponsoring registrar for any gTLD:

curl -sL https://rdap.org/domain/example.com \
  | jq -r '.entities[] | select(.roles | index("registrar")) | .vcardArray[1][] | select(.[0] == "fn") | .[3]'

Example Registrar, LLC

A traditional WHOIS lookup works too:

whois example.com | grep -iE "^ *registrar:"

   Registrar: Example Registrar, LLC

See what WHOIS is and how to look up a domain and what RDAP is for more on these lookups. If the domain was registered by a web designer or agency on your behalf, it may be in their account, in which case they'll need to request the code or move the domain to an account you control.

Using the Auth Code in a Transfer

Once you have the code, using it is straightforward:

1. Make sure the domain is unlocked (no clientTransferProhibited status). A registrar lock causes the transfer to be rejected even with a correct code.
2. At the new registrar, choose Transfer and enter the domain name.
3. Paste the auth code exactly as provided.
4. Complete payment and approve any confirmation emails.

The full process, including DNS precautions, is covered in how to transfer a domain to another registrar.

Copying the Code Correctly

Auth codes are usually long and mix upper and lower case letters, numbers and symbols. Small copying errors are the most common reason a code is rejected:

• Use the copy button if the dashboard provides one.
• Watch for spaces: Leading or trailing spaces often sneak in when copying from an email.
• Watch for look-alike characters: l, I and 1, or O and 0, are easy to confuse if you type the code manually.
• Check symbols: Some web forms or email clients mangle characters such as &, < or ". If a code with symbols keeps failing, ask the registrar to generate a new one.

You can check a copied code for hidden whitespace before pasting it into a form:

printf '%s' 'Xk9#qT2v!mR7pLs4 ' | cat -A

Xk9#qT2v!mR7pLs4 $

The space before $ shows a trailing space that would make the code fail. On macOS, use cat -vet instead of cat -A.

Keeping Your Auth Code Secure

The auth code is effectively the key to your domain. Anyone who has it, and whose transfer isn't blocked by a lock, can try to move the domain to a registrar account they control. Treat it like a password:

• Only request it when you're about to transfer: Don't leave codes sitting in old emails or shared documents.
• Don't share it over unencrypted channels where you can avoid it, such as a public chat or a support ticket that many people can read.
• Keep the transfer lock on at all other times. A lock means a leaked code can't be used on its own.
• Regenerate it after use or exposure: Most registrars let you reset the code. Do it if you started a transfer and cancelled, or if you suspect someone else saw it.
• Protect the registrar account: Anyone who can log in can request the code. Two-factor authentication, a unique password and a secure recovery email matter more than the code itself.

If you're selling a domain, give the buyer the code only after payment has cleared, ideally through an escrow service. See how to use a domain escrow service for how that process works. More general advice is in how to protect your domain from hijacking.

When the Auth Code Doesn't Work

If the gaining registrar says the code is invalid, work through these causes in order.

The Code Was Copied Incorrectly

Re-copy it directly from the source and paste it into a plain text editor first, to check for spaces or stray characters.

The Code Has Expired or Been Reset

Under the newer approach, codes have a limited lifetime, and some registrars reset the code after a failed or cancelled transfer. Request a fresh code and try again with that one.

The Domain Is Still Locked

A locked domain is rejected regardless of the code. Some registrar interfaces report this as an invalid code, which is confusing. Check the status:

curl -sL https://rdap.org/domain/example.com | jq -r '.status[]'

client transfer prohibited
client delete prohibited

client transfer prohibited means the lock is still on. Remove it and retry.

The Gaining Registrar's Form Changed the Code

Some web forms trim or encode special characters. Ask the gaining registrar's support to submit the transfer manually, or request a new code that contains only letters and numbers, if the losing registrar allows it.

The Domain Uses a Different System

Not every TLD uses an auth code. The most common exception is .uk, where transfers between registrars are done by changing the domain's IPS tag to the new registrar's tag at the current registrar. Other ccTLDs have their own processes, and some require the code to be requested from the registry directly. If your new registrar asks for a code you can't find, check whether your TLD uses one at all.

Other transfer failures that aren't about the code, such as recent registration locks or registry holds, are covered in why your domain transfer is stuck or failing.

Checklist: Getting Your Code Right First Time

1. Confirm which registrar holds the domain.
2. Update the registrant email so you can receive the code.
3. Turn off the transfer lock.
4. Request the code and copy it with the copy button.
5. Paste it at the gaining registrar within its validity period.
6. Approve the transfer emails.
7. After the transfer, re-enable the lock at the new registrar.

---

FAQ: Domain Auth Codes

---

Conclusion

A domain authorization code is the password that authorises moving a domain from one registrar to another. The gaining registrar submits it to the registry, and the transfer only proceeds if it matches. You get it from your current registrar's dashboard or by email to the registrant address, and newer rules mean it's increasingly generated on demand and valid for a limited time.

Treat the code as you would any important password. Request it only when you're ready to transfer, copy it carefully, keep the transfer lock on the rest of the time, and reset it if it's been exposed. With a secure registrar account and a working registrant email, getting and using the code is the quickest part of any transfer.