What it means
An auth code is a string of characters issued by a registrar that authorises the transfer of one specific domain to another registrar. It goes by several names, including EPP code, transfer key and auth-info code, all of which mean the same thing. Functionally it is a password for the act of moving the domain, and it is the single piece of information that makes a transfer possible.
Where to get one
It sits in the registrar's control panel, in the settings for the individual domain. Some registrars display it directly, others email it to the registrant address on request, and most require the domain to be unlocked first. If the registrant email on file is out of date, fix that before starting a sale, because a code that arrives at an address you no longer control is a problem with no quick resolution.
Why the timing of sharing it matters
An auth code plus an unlocked domain is everything a buyer needs to initiate a transfer, which means handing it over before payment hands over the asset. This is the most common way domain sellers lose a name in a private sale, and it usually happens for well-meaning reasons: the buyer asks to check the code works, the seller obliges. Release the code through escrow, or after funds are confirmed held, and not before.
When a transfer fails anyway
An invalid-code error is often the code rather than the transfer. Some registrars rotate codes on a schedule or invalidate them after a failed attempt, so generating a fresh one resolves most failures. Where it does not, the cause is usually a transfer lock, a domain that is still locked, or a registrant email that cannot receive the confirmation. Check those three in order.
Run a free valuation using the same multiples buyers pay — no email required.
Value it free →