What is a domain's Auth-code?

The Auth-code is an authorisation code that lets you start transferring a domain between registrars. It may also appear as EPP, AuthInfo, transfer code or domain secret.

The code authorises a request, but having it doesn't by itself prove the identity or ownership of whoever uses it. It doesn't replace other checks: some extensions also require you to unlock the domain or confirm the transfer by email.

When you need it

The procedure depends on the extension:

• Generic domains such as .com, .net and .org normally use an Auth-code or EPP code.
• .es, .com.es, .nom.es and .org.es domains use a specific authorisation code and a confirmation sent by Red.es.
• Other extensions may use a different process or not show this option in the panel.

Always check the relevant guide:

• Transfer .es, .com.es, .nom.es and .org.es domains.
• Transfer .com, .net, .org, .info and other generic domains.

Where to get it

The current registrar provides the Auth-code, usually from its domain panel or on request to its support. If the domain is managed at Hostsuar, follow the steps to get the Auth-code.

Treat it as a temporary credential: enter it only in the secure transfer form and don't publish it or paste it into an email or ticket.

If the code is incorrect

An Auth-code may be rejected because:

• It has expired or a new one was generated afterwards.
• It was copied with spaces at the start or end.
• A similar-looking character was mixed up.
• It belongs to another domain.

A domain lock or another open transfer can also block the transfer, even if the code is correct. Check the exact reason before generating a new one.

Request a new code from the current registrar, check the transfer lock and enter it again through the secure transfer flow.

Generating a new code may invalidate the previous one. Always use the latest one issued by the provider.

What the Auth-code doesn't do

The code only authorises the change of registrar. It doesn't copy the website, move the mailboxes or change the DNS automatically. If you also want to move the hosting, see how to migrate hosting to Hostsuar.

If it has been shared by mistake

Ask the current registrar to look into revoking or replacing it and check whether there is an unrequested transfer. Keep the lock on when it's available and you aren't going to transfer the domain. Changing your client area password doesn't guarantee that an Auth-code already issued is invalidated.