You need a domain authorization code when you move a name from one registrar to another. The new registrar asks for it, the old one confirms it matches, and the transfer goes through.
Every step and quote below was checked on the registrars’ own help pages on 18 October 2026. Menus change, but the logic holds.
What a domain transfer authorization code is
ICANN’s Transfer Policy calls it the “AuthInfo” code and requires that registrar-generated codes “must be unique on a per-domain basis”. Namecheap describes it as “a transfer security measure, which protects your rights as a domain owner”. Whoever holds the code can move the name, so treat it like a password.
The same thing goes by several names, which is why searches for “auth code”, “EPP code” and “domain authorisation code” all land in the same place:
| Name | Who uses it |
|---|---|
| AuthInfo code | ICANN Transfer Policy |
| Auth Code, Auth/EPP code | Namecheap |
| Authorization code, auth code, EPP code, transfer key | GoDaddy |
| Auth code, authentication code, “EPP in some systems” | Cloudflare Registrar |
| IPS tag (no code), then Transfer Authorisation Code | .uk domains (see below) |
ICANN also sets the floor for how registrars must hand it over. If a registrar does not let you generate the code yourself, it must provide it “within five (5) calendar days” of your request. It may not make getting the code harder than changing your contact details, and it “must not refuse” to release it “solely because there is a dispute” over payment.
Before you request it: lock, age and email
Three things block most requests before they start. First, the registrar lock. Namecheap’s checklist says the domain must be “Unlocked” for transfer (“Registrar Lock” is disabled). That lock shows up in WHOIS as clientTransferProhibited; our guide to domain status codes explains what each status means.
Second, the 60-day windows. Under ICANN’s policy a registrar may deny a transfer within 60 days of registration or of a previous transfer, and must deny one after a change of registrant if the registrant did not opt out of the 60-day lock. GoDaddy frames the contact-change lock as applying “if the current registrant opted to apply a 60–day lock”.
Third, the email address. Namecheap sends the code to the Registrant email address and warns that it “is not necessarily the same as your account email address.” GoDaddy also emails it to the registrant address. If that inbox is dead, fix the contact details first.
How to get the code at Namecheap, GoDaddy and Cloudflare
Namecheap’s guide to transferring a domain out gives the route: sign in, go to Domain List, click Manage next to the domain, open the Sharing & Transfer tab, and use the Transfer Out section to unlock it and request the Auth Code. You will be asked for a reason, and the code arrives by email.
At GoDaddy, open the Domain Portfolio, select the domain, choose Transfer to Another Registrar under Transfer, review the checklist and select Continue with transfer. Domain Protection then asks for a 2-step verification code or a one-time password. GoDaddy warns that Domain Privacy is turned off at this step. The code is shown on screen with a Copy to Clipboard button and emailed to the registrant.
At Cloudflare Registrar, go to Manage Domains, select Manage on the domain, then Configuration > Unlock and Confirm and Unlock. The code appears in the dashboard. Cloudflare adds a warning worth repeating: anyone with admin or super-admin permissions on the zone can “obtain authorization codes to transfer domains to other registrars.”
| Registrar | Where | How it arrives | After you submit it |
|---|---|---|---|
| Namecheap | Domain List, Manage, Sharing & Transfer, Transfer Out | Email to the registrant address | “Namecheap has 5 days to release your domain(s)” |
| GoDaddy | Domain Portfolio, Transfer, Transfer to Another Registrar | On screen and by email | “Typically take 5-7 days”, faster if you approve |
| Cloudflare | Manage Domains, Configuration > Unlock | In the dashboard; Regenerate if lost | Approve to start immediately, or it auto-approves on the fifth day |
When the domain authorization code doesn’t work
Namecheap notes that “Auth/EPP codes are case-sensitive and may include all special symbols and characters”, so paste it rather than retype it.
The second is a code that has drifted out of sync. Namecheap says codes “are periodically updated by the Registrar” and the change may not reach the registry straight away. If you entered the right code and the transfer still failed, ask your current registrar to sync it with the registry. At Cloudflare you can press Regenerate, or lock the domain and repeat the steps.
The third is the domain’s state. A name still locked or inside a 60-day window will be refused. So will one in redemption: Namecheap says “transferring out a domain that is in a redemption state is impossible”. If renewal is close, check the dates with the free Domain Expiry Checker, which shows when a name expires and, if it has lapsed, which stage it is in. Our guide on when expired domains become available covers those stages.
The .uk exception and its planned change
Country-code domains follow their own registries, and ICANN’s Transfer Policy covers gTLDs only. Namecheap warns that “.UK, .IS, .ES, .CH, .LI, .DE, .FR, .TO and others can have different transfer processes and requirements.”
The biggest exception is .uk. Today there is no code at all. Namecheap’s IPS tag article says: “While there’s no Auth/EPP code for these domains, an IPS tag change is required to transfer .UK domain names from one Registrar to another.” GoDaddy agrees: “You don’t need an auth code to transfer .uk domains to another company.” You change the IPS tag to the one held by the new registrar, and Namecheap asks you to allow 24 hours.
That is due to change. Nominet’s registrar FAQ says: “We have announced the transition will take place on Tuesday, 9th February 2027.” At that point, Nominet says, “Transfer Authorisation Codes (TACs) will be utilised for .UK domains”, and if the domain is unlocked and the code is correct, “the transfer will complete immediately for .UK domains.” Nominet has announced the date, but dates can slip: its own FAQ notes another change was delayed. Until then, a .uk move is an IPS tag change.
Selling a domain: when to hand over the code
If a buyer is moving your name to their own registrar, they will need the code. Send it only once their payment is held by a third party, never before. Our guide to domain escrow covers how that works. If buyer and seller use the same registrar, an account-to-account push usually needs no code at all; see how to transfer a domain to another person.
On the SERPHeroes Domain Marketplace, for example, “Escrow.com holds your payment, the seller transfers the domain, and the seller is paid only once you confirm you have it.” It is one venue among several; our guide on how to sell a domain name compares the routes.
A limitation: none of the registrar pages we checked say how long a code stays valid, and we have no data of our own on transfer failure rates. If a code is old, request a fresh one rather than assume.
Frequently asked questions
Is the auth code the same as the EPP code?
Yes. GoDaddy says authorization codes are “also known as auth code, EPP code, or transfer key”, and ICANN calls the same thing the “AuthInfo” code.
Why didn’t I receive my authorization code by email?
Namecheap and GoDaddy send it to the registrant email on the domain, which may differ from your account email. Check that address, update it if needed, and request the code again.
Can my registrar refuse to give me the code?
Under ICANN’s Transfer Policy, for gTLDs, a registrar must provide it within five calendar days if you cannot generate it yourself, and must not refuse solely over a payment dispute. The 60-day windows can still block the transfer itself.
Do .uk domains need an authorization code?
Not today: a .uk transfer is an IPS tag change. Nominet has announced a move to Transfer Authorisation Codes at its transition on Tuesday, 9 February 2027.
The takeaway Unlock the domain, confirm the registrant email works, check the 60-day windows, then request the code. Paste it, never retype it, and never send it to a buyer before payment is held.
