How to get a domain's auth (EPP) code from GoDaddy, Namecheap, Cloudflare and Spaceship

By the RenewRoster team · 5 November 2026 · 6 min read

Moving a client's domain to another registrar, or into your agency's account, needs one thing from the current registrar: the authorization code. Registrars also call it the auth code, EPP code or transfer key. It works like a one-time password for the transfer. Here's where to get it at four registrars agencies run into a lot, following each registrar's own help pages, plus the checks that stop a transfer from stalling.

Before you ask for the code

Find out which registrar it's actually at. Clients often don't know. A public RDAP/WHOIS lookup shows the registrar and expiry date; see how to find a client domain's registrar and expiry date.
Check the 60-day rule. Domains generally can't move within 60 days of being registered or transferred, and some registrars also apply a 60-day lock after a registrant contact change. See domain transfer lock and the 60-day rule.
Know who gets the email. Several registrars send the code to the domain's *registrant* email, which may be an old employee or freelancer, not whoever has the login.
Don't let it expire mid-transfer. If the domain is close to its expiry date, renew it first or start well ahead. A quick expiry check tells you how much time you have.
.uk domains are different. They don't use an auth code; the current registrar changes the domain's IPS tag to the new registrar instead.

GoDaddy

Go to your Domain Portfolio and select the domain.
Under Transfer, select Transfer to Another Registrar. If the domain isn't eligible, GoDaddy shows why.
Review the checklist and select Continue with transfer. Domains with Domain Protection ask for an identity check (2-step verification code or a one-time password).
Select Click here to see Authorization Code, then Copy to Clipboard.

GoDaddy also emails the code to the domain's registrant email. Note that Domain Privacy is switched off when you continue, so the contact details can move to the new registrar. For many domains at once, GoDaddy lets you get auth codes through a domain export (CSV).

Namecheap

Open Domain List and select Manage next to the domain.
Go to the Sharing & Transfer tab.
In Transfer Out, unlock the domain if it's locked, then request the Auth Code. Namecheap asks for a reason for the transfer.

Namecheap sends the code to the domain's registrant email address, and says plainly that this isn't necessarily your account email. If nobody reads that inbox, update the registrant email first (keeping the 60-day lock in mind). Some country-code domains (.uk, .de, .fr and others) follow different transfer processes.

Cloudflare Registrar

In the dashboard, go to Manage domains, find the domain and select Manage.
Select Configuration, then Unlock, and confirm with Confirm and Unlock.
Copy the auth code Cloudflare generates and give it to the new registrar.

Lost it? Select Regenerate, or lock and unlock the domain again. Cloudflare warns that anyone with Super Administrator or Administrator access to the account can unlock domains and get auth codes, so review who has those roles on a client's account. When the transfer request arrives, you can approve it in Cloudflare to speed it up; otherwise it auto-approves on the fifth day.

Spaceship

Open Domain Manager and select the domain.
Select Transfer in the side panel, then Transfer domain. Spaceship's own transfer page confirms this path; confirm any warning about connected services that may stop when the domain leaves.
Unlock the domain if it is locked, then copy the Authorization/EPP code shown for the transfer. Exact button labels can vary as the Domain Manager UI changes, so follow the on-screen Transfer flow if a step looks different.

Spaceship also documents an API endpoint that returns a domain's auth code, which helps when you're moving a batch.

When the code doesn't work

The code never arrived. Check spam, then check which address it went to. At GoDaddy and Namecheap that's the registrant email on the domain.
The new registrar rejects it. Copy and paste it rather than typing, and watch for trailing spaces. Codes can go stale, so request a fresh one if it's been sitting for a while.
The domain is still locked. Re-check the lock status at the current registrar, or look up the domain's status codes: clientTransferProhibited means it's still locked.
It's inside the 60-day window. Wait it out; the new registrar can't override it. More in the 60-day transfer lock guide.

After the transfer

A transfer usually takes up to five days unless the old registrar approves it sooner. When it completes, check that the expiry date moved (most transfers add a year), that auto-renew is on at the new registrar (how to turn it on), and that DNS still points where it should.

Handing a domain back to a client when a contract ends? The client offboarding checklist covers the rest: DNS, SSL and logins. Taking on a new client? Start with the onboarding checklist.

Keep an eye on every client domain

Transfers are when expiry dates and auto-renew settings get lost. RenewRoster tracks every client's domain and SSL expiry in one list, reads dates from public RDAP/WHOIS records (no registrar logins needed), and alerts you at 60, 30, 14 and 3 days. It's free for 5 domains or certificates.

Let RenewRoster watch every renewal for you

RenewRoster tracks every client's domain and SSL expiry dates, sends reminders at 60, 30, 14 and 3 days (under your agency's brand if you like) and gives you a monthly renewals report. Free for 5 domains, no card needed.

Start free: 5 domains, no card

Sources

Keep reading

Check a domain + SSL now, free