What an EPP or authorization code is and how to get it

An EPP code, also called an authorization code, auth code, or transfer secret, is a unique password tied to a specific domain name. It proves to the gaining registrar that you are the legitimate owner and are authorizing the domain to move. You get it from your current registrar's control panel, and you must hand it to the new registrar to complete any transfer.

What EPP stands for and why it exists

EPP is short for Extensible Provisioning Protocol, the standard registrars use to communicate with domain registries. The authorization code is the piece of that system that guards transfers. Without it, anyone who knew your domain name could try to pull it away from you. The code acts like a one-time key: the registry will not release the domain to a new registrar unless the correct code is presented.

A few important characteristics to understand:

• The code is case sensitive and usually 8 to 16 characters, mixing letters, numbers, and symbols.
• It applies to one domain only. If you are moving several names, each has its own code.
• Most gTLDs such as .com, .net, and .org require it. Some country-code TLDs use a different mechanism or none at all.
• It can expire or be regenerated, so request it close to the time you actually start the transfer.

How to get your EPP or authorization code

The exact wording varies between registrars, but the process follows the same pattern. Log in to the account that currently holds the domain, not the new one.

1. Sign in to your current registrar or the control panel where the domain is managed.
2. Open the domain list and click the specific domain you want to transfer.
3. Find the transfer or security section. Look for a label like Get EPP Code, Transfer Out, Authorization Code, or Domain Secret.
4. Unlock the domain first. A registrar lock (also called clientTransferProhibited) blocks transfers, so toggle it off before or during this step.
5. Request or reveal the code. Some registrars display it on screen; others email it to the registrant contact on file.
6. Copy the code exactly, including any symbols and letter casing, and paste it rather than retype it.

If the code is emailed, confirm the registrant email address in the WHOIS or contact record is current. If it is out of date, update it before you start, or the message may go to an inbox you cannot reach.

Using the code to complete a transfer

Once you have the code, start the transfer at the gaining registrar. During checkout it will ask for the domain and the authorization code. After you submit it, the registry sends a confirmation request to the registrant email, and the transfer typically completes within five to seven days per ICANN policy. You can read the official rules in the ICANN Transfer Policy.

Two prerequisites trip people up most often:

• Registrar lock must be off. A locked domain rejects the transfer even with a valid code.
• The domain must be older than 60 days. Newly registered or recently transferred domains are frozen for 60 days and cannot move.

Security and good practice

Treat the auth code like a password. Do not post it in support tickets, chat, or public forums. If you requested a code but decided not to transfer, many registrars let you regenerate it, which invalidates the old one. After a successful transfer, the code from the old registrar is spent and no longer works.

If you are moving a domain to ASEOHosting so it sits alongside your hosting and dedicated Class C IP, our team can walk you through the incoming transfer and DNS cutover. See our domain transfer page, or if you are registering something new, start at domain registration. For anything specific to your account, reach us through contact us.