Authorization Codes Explained: Getting Your EPP Key for a Clean Transfer

You closed the acquisition, the funds cleared, and the domain is yours. Then the transfer stalls on a single field: authorization code. For a credential that fits on one line, the EPP key causes an outsized share of transfer delays—usually because nobody explained what it actually does or where it lives. This guide fixes that.

Treat the authorization code as the master key to your digital real estate. Understand it once, and every future transfer becomes a routine step instead of a scramble.

What Is a Domain Authorization Code (EPP)?

A domain authorization code—often called an EPP code, auth code, transfer key, or EPP key—is a unique, case-sensitive password assigned to a domain name. It proves to the gaining registrar that whoever is requesting the transfer is genuinely authorized to move the domain.

"EPP" stands for Extensible Provisioning Protocol, the standardized language registrars use to communicate with domain registries. When you initiate a transfer, the EPP code is the credential that unlocks the domain for release from its current registrar and hands control to the new one. Without it, the registry simply refuses to move the name.

Think of it this way: the domain registration is the deed to the property, and the EPP code is the key that lets you hand that deed to someone else. Anyone holding the correct code can request a transfer—which is exactly why the code is treated as sensitive information.

The authorization code isn't a formality. It's the core security mechanism that prevents unauthorized parties from hijacking a domain out from under its owner.

Which extensions require an EPP code?

Nearly all generic top-level domains (gTLDs)—.com, .net, .org, .io, .co, and the vast majority of newer extensions—require an authorization code to transfer. This is standardized under ICANN's Transfer Policy, which governs how domains move between registrars.

The main exceptions are certain country-code TLDs (ccTLDs) that run their own transfer processes. Some use auth codes, some use a different authorization method entirely, and a few require registry-level paperwork. If you're acquiring a ccTLD, confirm the specific process before you assume the standard EPP flow applies.

Why the EPP Code Matters for a Clean Transfer

For operators moving domains in and out of a portfolio, the auth code is the difference between a transfer that completes quietly and one that drags on for days. Three things make it critical:

• Security. The code is the primary defense against unauthorized transfers. A domain with an unknown or leaked auth code is a domain at risk.
• Accuracy. EPP codes are case-sensitive and frequently contain special characters. A single mistyped symbol produces a rejection with a vague error message—one of the most common causes of a stalled transfer.
• Timing. The code must be valid at the moment the gaining registrar submits the request. Some registrars expire or regenerate codes, so a key you grabbed weeks ago may no longer work.

If you're mapping out the full acquisition-to-control workflow, our step-by-step transfer walkthrough shows where the auth code fits into the larger sequence.

Where to Find Your Authorization Code

The auth code always comes from the current (losing) registrar—the one where the domain lives today. You cannot generate it at the new registrar; you request it from the old one and hand it over. Here's the general process, which is nearly identical across major registrars:

1. Log in to your current registrar account. Navigate to the domain management or DNS dashboard.
2. Select the specific domain you intend to transfer.
3. Unlock the domain. Most registrars keep a "registrar lock" (also called clientTransferProhibited) enabled by default. This must be turned off before a code will work.
4. Request or reveal the authorization code. Look for a button labeled "Get EPP code," "Transfer," "Auth code," or "Authorization code." The registrar will display it on screen or email it to the registrant's contact address.
5. Copy it exactly. Use copy-paste rather than retyping to preserve case and special characters.

If the domain was just purchased, note that a mandatory 60-day lock may prevent transfers entirely—regardless of whether you have the code. We break down that rule and how to plan around it in this guide to the 60-day transfer lock.

What a code looks like

A typical EPP code is a string of 8 to 16 characters mixing uppercase and lowercase letters, numbers, and symbols—something like Kf7$mQ9!pReW2z. If your registrar shows a short, simple code, some registries will reject it during transfer as insufficiently secure. When that happens, regenerating a stronger code usually resolves it.

Handling the Code Securely

Because the auth code grants transfer authority, treat it like a password with real financial consequences. A few practical habits:

• Don't share it broadly. Only the gaining registrar needs it, and only during the active transfer window.
• Deliver it through secure channels. If you're coordinating an acquisition, pass the code via an encrypted or trusted method—not a public thread or an unsecured message.
• Regenerate after use. Once a transfer completes, the code effectively resets. If a transfer is cancelled, consider regenerating the code so any previously shared copy is void.
• Re-lock after transfer. Once the domain lands at its new home, turn the registrar lock back on to protect it.

These habits become second nature once you manage a portfolio of any size. For a broader view of protecting domains as strategic assets, our overview of premium versus cheap domains explains why the names worth acquiring are also the names worth defending.

When the Auth Code Isn't the Whole Story

A valid EPP code is necessary but not always sufficient. A transfer can still stall if the domain is locked, if WHOIS contact details are outdated, if the domain is inside a redemption or grace period, or if the losing registrar hasn't released it. If you've entered the correct code and the transfer still won't move, work through our transfer troubleshooting checklist to isolate the cause.

Operators should also plan for continuity. A transfer done carelessly can interrupt live email or web services. If the domain you're moving is already in production, follow our guidance on transferring without downtime or losing email before you pull the trigger.

And because transfers carry costs—renewal charges, extension fees, and occasional surprises—it's worth knowing what you'll actually pay. Our breakdown of transfer costs and renewal fees covers the numbers that matter.

The Operator's Takeaway

The EPP authorization code is a small credential with big leverage. Get it from the current registrar, keep it exact, move it securely, and it becomes the quiet hinge on which a clean transfer turns. Botch it, and you'll spend days chasing vague error messages. The professionals who move domains routinely aren't smarter about it—they've just made the auth code a checklist item instead of a surprise.

At PixelWorks Domains, every name we release is documented for a smooth handoff, so acquiring a strategic asset never turns into a transfer headache. Browse our curated inventory when you're building your next position—or reach out about a specific domain, and we'll walk the acquisition and transfer through with you, start to finish.