Auth Code (EPP Code / Transfer Key)
An auth code — also called an EPP code, authorization code, or transfer key — is a per-domain password that proves you control a domain when transferring it to a new registrar. The losing registrar issues it; the gaining registrar requires it to start the transfer. Without a valid auth code, a gTLD transfer request cannot proceed.
How it fits into a transfer
The standard flow: unlock the domain (clear the registrar lock), request the auth code from the current registrar's dashboard, submit it at the gaining registrar with payment, and approve any confirmation email. The transfer then completes — often within about five days for gTLDs, or immediately if the losing registrar allows an explicit approval.
Handling auth codes safely
- •Treat an auth code like a password to the domain itself — anyone holding it (with the domain unlocked) can initiate a transfer.
- •Codes are commonly time-limited or single-use; request a fresh one when you are actually ready to transfer.
- •In a domain sale, send the auth code only through the escrow or marketplace flow, never ahead of payment.
Frequently Asked Questions
Where do I find my domain's auth code?
In the current registrar's dashboard, usually under the domain's transfer or security settings. Some registrars email it instead of displaying it. The domain typically must be unlocked first.
Do all TLDs use auth codes?
All gTLDs do — it is part of ICANN's transfer policy. Many ccTLDs use them too, but some have their own transfer procedures, so check the specific registry's process.