The EPP code, also called the authorisation code, auth code or transfer key, proves you are entitled to move a domain to another registrar. Without it a transfer cannot start, and it is the step where most transfers stall.
Getting one
Request it from your current registrar, not the one you are moving to.
In their control panel, find the domain and look for an option named EPP Code, Authorization Code, Auth Code, Transfer Key or Get Transfer Code. Every registrar names it differently and hides it somewhere different; their search box is usually faster than the menu.
Some show it on screen immediately. Others email it to the WHOIS contact address, sometimes after a delay of hours.
Unlock the domain at the same time
Domains are locked by default to prevent unauthorised transfers, and a locked domain refuses a transfer regardless of how correct the EPP code is.
Unlock it in the same control panel, usually a toggle labelled Registrar Lock or Transfer Lock. Do this while you are there, because the two failures look identical from the outside.
Domain locking walks through why it exists and why you turn it back on afterwards.
Turn off WHOIS privacy first
This is the reason most EPP codes never arrive.
Privacy services replace your contact details with their own, so the code is emailed to a forwarding address belonging to the proxy. It frequently does not reach you, and nothing indicates why.
Turn privacy off before requesting the code, and turn it back on once the transfer completes.
Check the WHOIS email is one you can read
Look up the domain's WHOIS record and confirm the contact address is live. On a domain registered years ago it is often an address at a company you have left or a mailbox that no longer exists.
Update it at the registrar before requesting the code. Both the code and the later transfer approval go there.
Note that changing the registrant contact can itself trigger a 60-day transfer lock at some registrars. If you have to change it, do that first and wait, rather than discovering the lock mid-transfer.
The 60-day rule
A domain cannot be transferred within 60 days of registration, or within 60 days of a previous transfer. This is a registry rule and no registrar can override it.
If your domain is inside that window, there is nothing to do but wait. Requesting the code repeatedly will not help.
Using it
Start the transfer at the new registrar and paste the code exactly. Watch for a trailing space when copying from an email. A stray character produces an invalid-code error that looks like the code is wrong when only the paste was.
Codes expire. Request one when you are ready to move, not weeks in advance, or you will be requesting a second one.
Transferring your domain explains what happens after the code is accepted.
When the registrar will not provide it
They are generally obliged to, and delaying tactics are not permitted. If a registrar refuses, delays repeatedly, or requires you to call a retention line, that is worth pressing on.
Legitimate reasons for refusal are narrow: the domain is inside the 60-day window, it is expired or in redemption, there is an unpaid balance, or a dispute is in progress.
"You must speak to an advisor first" is not one of them.
Quick checklist
- Confirm the domain is more than 60 days old and was not transferred recently.
- Check the WHOIS contact email is one you can read; update it if not.
- Turn WHOIS privacy off.
- Unlock the domain.
- Request the EPP code.
- Start the transfer promptly and paste the code carefully.
- Approve it from the email sent to the WHOIS address.
- Re-enable privacy and the lock once it completes.
Codes are frequently regenerated when a domain is unlocked, which is one of several reasons a transfer is refused. See What to Do When a Domain Transfer Fails.
Where the code actually arrives
People wait for a code that has already been delivered somewhere they are not looking.
Registrars differ. Some show it on screen immediately, some email it to the registrant address on the domain, and some email it to the account address, which may be a different address entirely.
whois example.com | grep -iE 'registrant email|admin email|registrar:'
Read which address the record holds before requesting the code. If it is an address at the domain being transferred, and the transfer is happening because that mail is unreliable, fix the contact address first and wait for it to propagate.
Check the spam folder as a matter of routine. The message is automated, contains a long code and links, and is exactly the shape of thing filters dislike.
Codes expire and change
The code is not a permanent property of the domain, and treating it as one produces a failed transfer with no obvious cause.
Many registrars issue one that is valid for a limited period, and some regenerate it whenever it is requested again. Requesting a fresh copy while a transfer is pending can therefore invalidate the one already submitted.
The practical rule is to request it once, use it immediately, and if the transfer fails, request a new one rather than reusing the old. Copy it by selecting the whole string, since a trailing space or a missing final character produces the same refusal as a wrong code and looks identical.
What the code does not do
Having it in hand feels like the hard part is done, and three other things can still stop the transfer.
The domain has to be unlocked, and unlocking is separate from obtaining the code. The contact details have to be verified, since an unverified domain is suspended rather than transferred. And the domain must be outside any period during which transfer is refused, whether because it was recently registered or recently transferred.
whois example.com | grep -iE 'status|created|transfer'
Read every status line rather than the first. A domain can carry several at once, and clearing one leaves the others in place. What to do when a domain transfer fails goes into each refusal.