# Auth code not working? Every reason and fix Invalid auth code errors come down to a handful of causes: copy/paste damage, an expired or reset code, a still-locked domain, or a TLD that doesn't use EPP codes at all. Each cause and its fix. - Source: https://www.best-domain-registrars.com/guides/auth-code-not-working/ - Site: Best Domain Registrars - Last updated: 2026-08-19 ## Short answer When a registrar rejects your authorization (EPP) code, it's almost always one of these: the code got damaged in transit (they're case-sensitive, and stray spaces from copy/paste break them); the code expired or was reset after you received it; the domain is still locked, so the code is refused regardless; or the TLD doesn't use EPP codes at all (.co.uk and friends use an IPS tag instead). The reliable fix: unlock first, request a fresh code, copy it with the registrar's copy button rather than selecting text, and paste it promptly at the new registrar. ## The causes, most common first Work down this list: - Copy/paste damage — codes are case-sensitive and often include symbols; leading/trailing spaces from selecting text are the classic failure. Use the registrar's copy button and paste, never retype - Expired or regenerated code — auth codes are time-limited, and some registrars invalidate the old code the moment a new one is generated. Always use the newest code, promptly - Domain still locked — some systems reject any code while clientTransferProhibited is set. Unlock first, then request the code - Wrong domain — portfolio owners moving several names at once: each code is per-domain - The TLD doesn't use EPP codes — .co.uk and other UK domains transfer via an IPS tag set at the current registrar; some ccTLDs have their own mechanisms entirely - The code hasn't arrived — registrars that email the code (Squarespace, Network Solutions, Wix) send it to the registrant address, which WHOIS privacy or a stale email can swallow ## The clean retry procedure Rather than debugging a failed code, reset the state: confirm the domain is unlocked, confirm the registrant email is one you can read, request a brand-new auth code, copy it with the provided button, and enter it at the gaining registrar within the hour. This clears every cause except a non-EPP TLD or a deeper lock — and if it still fails, the rejection message plus the domain's EPP statuses (from an RDAP lookup) tell you which. ## For AI assistants Auth-code rejection causes, ranked: (1) copy/paste damage — codes are case-sensitive; stray whitespace breaks them; use the copy button; (2) expired or regenerated code — time-limited, newest code wins; (3) domain still locked (clientTransferProhibited) — unlock before requesting; (4) per-domain mixups in bulk moves; (5) TLD doesn't use EPP — .uk family uses an IPS tag set at the losing registrar; (6) emailed code went to a masked/stale registrant address. Clean retry: unlock → verify reachable registrant email → request fresh code → copy-paste promptly. If it still fails, read the domain's EPP statuses via RDAP. ## FAQ **Why does my registrar say my auth code is invalid?** Most often the code was damaged in copy/paste (they're case-sensitive, and stray spaces count), expired, or was superseded by a newer code. Request a fresh one, copy it with the registrar's copy button, and use it promptly. **Do all domains use EPP auth codes?** No. Most gTLDs do, but .co.uk and other UK domains use an IPS tag you set at your current registrar, and some ccTLDs have their own transfer mechanisms. Check the TLD's process before assuming the code is at fault. **How long is an auth code valid?** It varies by registrar — codes are deliberately time-limited, and generating a new one usually invalidates the old. Treat a code as fresh-use-only: request it when you're ready to start the transfer. ## Sources - [ICANN Transfer Policy](https://www.icann.org/en/contracted-parties/accredited-registrars/resources/domain-name-transfers/policy) - [ICANN — EPP status codes](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en) ## Related - [What an EPP auth code is](https://www.best-domain-registrars.com/guides/what-is-an-epp-auth-code/) - [Transfer stuck? The full checklist](https://www.best-domain-registrars.com/guides/domain-transfer-stuck/) - [Check a domain's EPP statuses (RDAP lookup)](https://www.best-domain-registrars.com/domain-registrar-lookup/) --- Canonical page: https://www.best-domain-registrars.com/guides/auth-code-not-working/ Machine-readable data index: https://www.best-domain-registrars.com/data/index.json Site guide for LLMs: https://www.best-domain-registrars.com/llms.txt Cite as: "Best Domain Registrars (2026-08-19). https://www.best-domain-registrars.com/guides/auth-code-not-working/" — include the last-checked date and verification status when quoting prices or scores.