What Is an EPP / Auth Code and Where to Find It

What an EPP / auth code is

EPP stands for Extensible Provisioning Protocol, the behind-the-scenes protocol registrars use to talk to domain registries. The auth code (you'll also see it called an authorization code, auth-info code, transfer key, EPP key, or domain secret) is a per-domain password stored at the registry.

Its whole job is security. Requiring a code that only the current owner can retrieve is what stops someone from yanking your domain to another registrar without permission. For generic top-level domains like .com, .net, and .org, this code is mandatory for any inter-registrar transfer, no code, no transfer.

Where to find it

The auth code lives with your current (losing) registrar, in the control panel for that specific domain. The exact wording varies, but the path is almost always the same shape: find the domain, look for transfer or security settings, and reveal or request the code.

A typical retrieval looks like this:

• Log in to your current registrar and open the domain's management page.
• Unlock the domain first, remove the registrar lock (clientTransferProhibited). Many registrars hide or refuse to issue the code while the domain is locked.
• Find "Transfer," "EPP code," "Auth code," or "Get authorization code" and reveal or request it.
• Some registrars display it on screen; others email it to the registrant contact on file, so make sure that email address is current.

How it's used in a transfer

The auth code is one step in a defined sequence. Once you have it, you initiate the transfer at the new (gaining) registrar and paste it in when prompted. The registry uses it to verify the request is legitimate before the two registrars complete the handoff.

The full flow, in order:

• Unlock the domain at your current registrar and disable WHOIS/domain privacy if the transfer requires a verifiable contact.
• Retrieve the auth code.
• Start the transfer at the new registrar and enter the code.
• Approve the transfer confirmation email(s); for gTLDs there's typically a 5-day window before it completes automatically.

Common gotchas

Most failed transfers come down to a handful of predictable snags. The domain is still locked, so the code was never issued. WHOIS privacy is masking the contact email and the confirmation never arrives. Or the domain is inside a 60-day lock, ICANN prohibits transfers for 60 days after an initial registration or a previous transfer, and many registrars apply the same window after a contact/owner change.

Two more worth knowing. Auth codes can expire or be regenerated, so if a code is a few weeks old, request a fresh one before blaming the new registrar. And not every extension uses this system the same way: some country-code TLDs (like .uk, which uses an IPS tag, or .de and .au, which have their own processes) don't use a standard EPP auth code at all. Check your specific TLD's transfer procedure rather than assuming .com rules apply.

Treat the code like a password, and watch the domain

Because the auth code is effectively the key to hijacking a domain, handle it like a credential: share it only with the gaining registrar during an active transfer, and never paste it into a support chat or forward it casually. Once the transfer is done, the code is regenerated, so an old one is harmless, but during the window it matters.

Transfers are also a classic moment for a domain to slip through the cracks, auto-renew settings don't always carry over, and a domain mid-move is a domain nobody's watching. Confirm the registration date with a quick domain expiry check, and if you manage more than a couple of names, put expiry and DNS drift on autopilot so a lapse can't sneak up on you. VigilDog's monitoring is built for exactly that across a whole portfolio.