An auth code is a unique password that authorises the transfer of a domain from one registrar to another.
An auth code (short for authorisation code, and also called an EPP code or transfer key) is a password attached to a single domain name. You give it to your new registrar when you move a domain, and it proves you have the right to take the domain with you.
Think of it like the code you get when you switch mobile networks and keep your number. Your old provider gives it to you, you hand it to the new one, and the move goes ahead. Without the code, the new registrar can't start the transfer.
How to use an auth code to transfer a domain
The usual steps look like this:
- Make sure the domain is at least 60 days old and hasn't been transferred in the last 60 days, because of ICANN's transfer lock. A recent change of owner details can also trigger a 60-day lock at many registrars.
- Remove the domain lock at your current registrar.
- Request the auth code from your current registrar's control panel or support team.
- Start the transfer at the new registrar and enter the code when asked.
- Approve any confirmation email, then wait for the transfer to complete, which is often up to 5 days for generic domains like .com.
A transfer of a generic domain usually adds a year to its registration, so you don't lose the time you've already paid for.
Where to find your auth code
Most registrars show the auth code in the domain's settings, under a heading like "Transfer", "EPP code" or "Authorisation code". Some email it to the administrative contact or registrant instead of showing it on screen. Under ICANN rules, your registrar must provide it within 5 days of your request, and it can't refuse just because you're leaving.
Auth code vs EPP code
They're the same thing. "EPP" refers to the Extensible Provisioning Protocol, the system registrars use to talk to registries, while "auth code" describes what the code does. Some country-code domains use different names or processes entirely. A .uk domain, for example, uses an IPS tag instead of an auth code.
Common auth code problems
- "Invalid auth code": codes are case-sensitive and often contain symbols, so copy and paste rather than retype. Spaces at the start or end also cause errors.
- Code has expired or changed: some registrars generate a fresh code each time you ask, so use the latest one.
- Domain is still locked: the code alone isn't enough if the transfer lock is still switched on.
Keep your auth code private, because anyone with it and an unlocked domain could try to move it. With AblePage, transfers away are free once the 60-day ICANN lock has passed.