Domain Transfer Authorization Code: What It Is and How to Get It

An authorization code is a per-domain secret that proves you control the registration. Auth code, Auth-Info code, EPP code, EPP key and transfer key all refer to the same thing, and under ICANN rules your registrar must supply it within five calendar days of your request.

The confusing part is entirely the naming. Six terms circulate for one value, different registrars label the field differently, and someone searching for an EPP key on a registrar that calls it a transfer key can reasonably conclude their registrar does not offer one.

It is one thing, and it works the same way everywhere.

Table of contents

• What it is and why it exists
• Getting it
• Why a valid-looking code gets rejected
• The code is one step of five
• How this fits the rest of the stack
• FAQ

What it is and why it exists

It is a password scoped to a single domain, created by the registrar, and required by the gaining registrar to accept a transfer request.

It exists because domain hijacking would otherwise be trivial. Without a shared secret, anyone who knew a domain name could request it, and the only defence would be the confirmation email — which is exactly what an attacker who has compromised your mailbox already controls. The code adds a second thing they need.

Two properties follow from that, and both matter in practice:

• Treat it as a credential. Do not paste it into a support chat, a shared document, or an email you would not send a password in. Anyone with the code and access to the registrant email can move your domain.
• Regenerate it after use. Most registrars invalidate it once a transfer completes, but if a transfer was abandoned, the code may still be live. Generating a fresh one invalidates the old.

It is not a permanent identifier. It can be regenerated whenever you like, and doing so before a transfer is a reasonable habit rather than an inconvenience.

Getting it

Most registrars expose it in the domain’s settings, usually near the transfer or lock controls. Look for any of: Auth Code, Authorization Code, EPP Code, EPP Key, Transfer Code, Transfer Key, Auth-Info.

The usual path:

1. Open the domain in your registrar’s control panel.
2. Find the transfer section, and unlock the domain if it is locked.
3. Request or reveal the authorization code. Many registrars email it to the registrant address rather than displaying it.
4. Copy it exactly — codes are case-sensitive and often contain characters that are easy to misread.

That last point causes more failed transfers than it should. A code containing a capital I, a lowercase l, a digit 1, a capital O and a zero is a transcription hazard. Copy and paste; do not retype, and watch for a trailing space when pasting.

If the registrar does not offer it in the panel, contact support and ask. This is not a favour — ICANN requires the registrar to provide the code within five calendar days of the request, and a registrar that stalls is not permitted to. If it goes past that, ICANN operates a complaint process, and mentioning it tends to accelerate matters.

Some registrars require WHOIS privacy to be disabled before revealing the code, because the code often goes to the registrant email and privacy masks it. Turn it off, get the code, turn it back on after the transfer.

Why a valid-looking code gets rejected

The gaining registrar reports an invalid authorization code for several reasons that have nothing to do with the code being wrong.

• A transcription error. Case, a leading or trailing space, a character misread. Retry with a clean paste before assuming anything else.
• The code expired. Some registrars issue codes with a validity window. Generate a fresh one.
• It was regenerated. If anyone requested a new code after you copied yours, yours is dead.
• The domain is still locked. Some systems report this as a code failure rather than as a lock failure, which is unhelpful. Check the WHOIS status for clientTransferProhibited rather than trusting the control panel display.
• A sixty-day lock applies. Newly registered domains, recently transferred domains, and domains whose registrant details changed in the last sixty days cannot move at all. The code is fine; the domain is not eligible.

Check the actual state at the registry rather than in a dashboard:

whois example.com | grep -iE 'status|registrar|expiry'

clientTransferProhibited means locked. pendingTransfer means a request is already in flight — possibly one you started and forgot, and a second request will not succeed while the first is open.

The code is one step of five

Getting the code is often treated as the transfer, and it is one part. The full sequence:

1. Move DNS somewhere independent of either registrar first. This is the step that prevents an outage, because records hosted on the losing registrar’s nameservers can stop being served once the domain leaves.
2. Unlock the domain.
3. Get the authorization code.
4. Start the transfer at the new registrar and pay the fee, which adds a year to the registration rather than resetting it.
5. Approve the confirmation email sent to the registrant address, then wait up to five days for release.

Afterwards, re-lock the domain. Transfers commonly leave it unlocked, and an unlocked domain plus a compromised email account is the standard hijacking recipe. Also re-enable auto-renew, which does not carry across, and confirm the expiry date gained its year.

The single most common silent failure in the whole process is the confirmation email going unanswered. It expires rather than proceeding, and nothing tells you the transfer died — you simply notice weeks later that the domain never moved.

How this fits the rest of the stack

An authorization code is a small piece of security theatre that turns out not to be theatre: it is the thing standing between your domain and anyone who can read your email. Treat it accordingly, and regenerate it when a transfer does not complete.

What sits behind the domain is where the ongoing work is. On RunxBuild, attaching a custom domain to a static site or a web service issues and renews the TLS certificate automatically, with redirects, rewrites, response headers and SPA fallback configured in the dashboard rather than in files on a server. Static sites include 120GB of bandwidth, then $0.10/GB. Services in Node, Next.js, Python, Go, Ruby, Java, .NET or Docker deploy from your GitHub repository with build and runtime logs in one place and rollback to the previous deploy, and managed MySQL and Postgres run behind them on private networking. To see what a site, a service and a database add up to, the RunxBuild hosting calculator lists them as separate line items.

Useful related references:

• Free Domain Transfer: IONOS, Cloudflare, and the Right Steps
• What Is a .link Domain, and When Does It Fit a Project?
• Domain Squatting: What It Is, What You Can Do, and What Is Not Worth Doing
• Custom domains and certificates on RunxBuild

FAQ

What is a domain transfer authorization code?

A per-domain secret created by your registrar that the gaining registrar requires to accept a transfer. It functions as a password for that specific domain and prevents anyone who merely knows the domain name from initiating a move. Auth code, EPP code, EPP key, transfer key and Auth-Info all mean the same thing.

How do I get my auth code?

Look in your registrar’s control panel under the domain’s transfer or security settings — the label varies. Many registrars email it to the registrant address rather than displaying it. If it is not available in the panel, ask support: ICANN requires the code to be provided within five calendar days of your request.

Why does my registrar say the authorization code is invalid?

Usually a transcription problem — codes are case-sensitive and easy to mistype, so copy and paste and check for a trailing space. Otherwise the code may have expired or been regenerated, or the domain may still be locked, which some systems report as a code failure. Check the WHOIS status directly.

Is the authorization code the same as my registrar password?

No. Your account password protects every domain in the account; the authorization code is scoped to one domain and exists specifically to authorise transfers. Treat it as a credential regardless — anyone holding it plus access to the registrant email can move the domain.

Should I regenerate the code after a transfer?

Most registrars invalidate it automatically once a transfer completes. If a transfer was started and abandoned, the code may still be live, so generate a new one to invalidate it. Regenerating is free and takes seconds, and it is a reasonable habit before any planned transfer.