What is an EPP or authorization code for a domain?

An EPP code, also called an authorization code or auth code, is a one-off password for your domain name. The registrar you use today creates it, and the registrar you are moving to asks for it, as proof that the domain's owner agrees to the move. You only need it to transfer a domain to another company. You do not need it to point your domain at a new website, set up email or renew.

Where the name comes from

EPP stands for Extensible Provisioning Protocol. It is the system registrars use to talk to the registries that run each domain ending, such as the one behind .com. The code is a field in that system: when a new registrar asks the registry to move your domain, it has to supply the right code or the request is refused.

You will see the same thing under several names, depending on the company:

EPP code or EPP key
Authorization code, auth code or auth-info code
Transfer key, transfer code or transfer secret

They all mean the same thing. A few country endings work differently. Domains ending in .uk, for example, move by changing a "tag" at the current registrar rather than with a code.

What it looks like

A typical code is a jumble of 8 to 32 characters mixing upper and lower case letters, numbers and symbols, something like "xQ7#vLp2!rTz9". A few things about it trip people up:

It is case-sensitive. A capital Q and a small q are different characters.
Spaces count. When you copy it from an email, it is easy to pick up a space at the start or end. Paste it into a plain note first and check.
Some symbols look alike. A zero and a capital O, a small l and a capital I. Copy and paste rather than retype.
It can change. Some registrars make a fresh code each time you ask, and the old one stops working. Use the latest one you received.
It can expire. A few registrars set a time limit. If a transfer fails with "invalid code" a week after you got it, ask again.

Where to find it at the common registrars

Menus change often, so treat these as directions rather than exact clicks. If you cannot find it, search the registrar's own help pages for "authorization code".

GoDaddy: open your Domain Portfolio, choose the domain, and look in its settings for the transfer section. There is an option to transfer the domain to another registrar, which shows the code or emails it. You may need to turn off Domain Lock first.
Namecheap: go to Domain List, click Manage next to the domain, open the Sharing & Transfer tab and look for the Auth Code option. Namecheap emails it to the registrant address.
Squarespace Domains (including former Google Domains): open the domain, find the transfer or registration settings and request the auth code. The lock switch is in the same area.
Wix: in your Domains page, open the menu for the domain and choose to transfer it away from Wix. The code arrives by email.
Network Solutions: in Account Manager, open the domain, find the transfer settings and request the code. It is typically emailed to the admin contact. Network Solutions domains covers the account access problems that often come first there.

If you are not sure which company holds your domain, finding where your domain is registered shows how to look it up in a minute.

Why the code will not appear

When the transfer button is greyed out, or the code request leads nowhere, it is usually one of these:

The domain is locked. Turn off the transfer lock in the domain's settings, then ask again.
It is too new. For 60 days after a domain is registered or transferred, it generally cannot move again. The same often applies for 60 days after the owner's details change. Why you can't move your domain yet explains each lock.
It has expired or is close to it. Renew first.
The code went to an old email. If the owner email on the domain is a former employee's or a defunct address, the code is sitting in an inbox nobody reads. Update the email in the domain's contact details, then request again.
It is not your account. If a web designer or former partner holds the login, only they can request the code.
A protection add-on is active. Some registrars sell premium protection that requires extra identity checks before a code is released. Expect a phone call or an ID upload.

Keep it safe

The code is not a secret on the level of your bank PIN, because a transfer also needs the domain unlocked and usually needs an email approval. Still, treat it with some care:

Do not post it in a group chat or forward it widely. Send it only to the person running the transfer.
If you request a code and then change your mind, turn the transfer lock back on.
If you receive a code you did not ask for, someone may be trying to move your domain. Log in to your registrar directly (not through the email), turn the lock back on and change your password.

Mistakes worth avoiding

Using the code at the same registrar. If you are moving a domain between two accounts at the same company, that is usually an account change or "push", not a transfer, and the code is not used.
Mixing up domains. If you own several, each has its own code. Label them as you collect them.
Starting the transfer before checking DNS. If your website and email settings are kept by the registrar you are leaving, copy them first. The full order is in how to transfer a domain to another registrar.

What to do now

Decide whether you really need to move the domain, or only point it.
Check the owner email on the domain is one you read.
Turn off the transfer lock, request the code and copy it into a plain note.
Start the transfer at the new registrar within a day or two, while the code is fresh.

If you are moving your domain because a new website is on the way, you can see your site rebuilt first and sort out the domain once you know where it needs to point.