Auth code not working? Every reason and fix
When a registrar rejects your authorization (EPP) code, it's almost always one of these: the code got damaged in transit (they're case-sensitive, and stray spaces from copy/paste break them); the code expired or was reset after you received it; the domain is still locked, so the code is refused regardless; or the TLD doesn't use EPP codes at all (.co.uk and friends use an IPS tag instead). The reliable fix: unlock first, request a fresh code, copy it with the registrar's copy button rather than selecting text, and paste it promptly at the new registrar.
The causes, most common first
Work down this list:
- Copy/paste damage — codes are case-sensitive and often include symbols; leading/trailing spaces from selecting text are the classic failure. Use the registrar's copy button and paste, never retype
- Expired or regenerated code — auth codes are time-limited, and some registrars invalidate the old code the moment a new one is generated. Always use the newest code, promptly
- Domain still locked — some systems reject any code while clientTransferProhibited is set. Unlock first, then request the code
- Wrong domain — portfolio owners moving several names at once: each code is per-domain
- The TLD doesn't use EPP codes — .co.uk and other UK domains transfer via an IPS tag set at the current registrar; some ccTLDs have their own mechanisms entirely
- The code hasn't arrived — registrars that email the code (Squarespace, Network Solutions, Wix) send it to the registrant address, which WHOIS privacy or a stale email can swallow
The clean retry procedure
Rather than debugging a failed code, reset the state: confirm the domain is unlocked, confirm the registrant email is one you can read, request a brand-new auth code, copy it with the provided button, and enter it at the gaining registrar within the hour. This clears every cause except a non-EPP TLD or a deeper lock — and if it still fails, the rejection message plus the domain's EPP statuses (from an RDAP lookup) tell you which.
Auth-code rejection causes, ranked: (1) copy/paste damage — codes are case-sensitive; stray whitespace breaks them; use the copy button; (2) expired or regenerated code — time-limited, newest code wins; (3) domain still locked (clientTransferProhibited) — unlock before requesting; (4) per-domain mixups in bulk moves; (5) TLD doesn't use EPP — .uk family uses an IPS tag set at the losing registrar; (6) emailed code went to a masked/stale registrant address. Clean retry: unlock → verify reachable registrant email → request fresh code → copy-paste promptly. If it still fails, read the domain's EPP statuses via RDAP.