Client Domains
EPP code — The Credential That Decides Whether You Can Move a Client In
You have won the account, agreed a date and booked the work. Now everything depends on somebody at the outgoing supplier answering an email.
Straight answer first
An EPP or auth code is the transfer password for a domain, and for a reseller it is the dependency that sits outside your control on every inbound client move.
It also defines your own behaviour on the way out. Below: getting the code out of an incumbent, the locks and clocks that set your realistic date, handling somebody else's credential responsibly, and the exit you want to be known for.
Written by the Hosting Seller staff · Checked 24 August 2026
100+
Terms, defined for resellers
2 min
To read between tickets
Plain
English, not marketing copy
24/7
Counter cover, yours included
The current registrar issues it once the domain is unlocked, and you hand it to the new one. The code proves the request comes from whoever actually holds the name rather than from somebody who fancies it.
It works alongside the other transfer rules: the 60-day lock after a registration or a previous transfer, a confirmation message to the registrant, and the extra year of registration most transfers add. Any of those can move your date, so check them before you agree one.
Getting the code out of the incumbent
The request has to come from the client, in their own name, to the account holder at the outgoing supplier. Draft it for them, keep it short and civil, and give a date. A polite email from the client succeeds far more often than a technical one from you.
If it stalls, escalate through the client rather than around them. Accredited registrars are required to supply the code within set timeframes under the policies governing generic endings, and obstruction can be raised with the registry or the oversight body.
The locks and clocks that set your date
A name registered or transferred in the last 60 days is not moving, whatever anybody promises. Check the creation date and the status codes on a public lookup before you put a date in a project plan, because that is a lock nobody can waive for you.
Then check the expiry. A transfer close to expiry is a risk worth avoiding entirely; renew first, move afterwards, and lose a fortnight rather than a domain.
Handling somebody else's credential
An auth code combined with an unlocked domain authorises a transfer, so treat it as a live credential for as long as it works. Do not leave it in a ticket thread, a shared spreadsheet or a chat channel that half the company can read.
Codes serve one purpose and can be regenerated, so ask for a fresh one per move and consider it spent once the transfer completes. That habit also protects you from any suggestion you retained access you should not have.
The exit you want to be known for
One day a client will ask you for their code. Issue it the same day, unlocked, with a short note explaining what happens next and confirming nothing will be switched off while the transfer runs.
That costs you an account you had already lost and buys you a reputation you cannot buy any other way. Resellers who make leaving difficult get talked about, and never in the way they hoped.
Written for whoever carries the account
Unexplained jargon becomes a support ticket, and on a reseller account somebody else's support ticket becomes yours. So we defined the terms once, in the language we would use across the counter to a peer.
Daily backups run on every plan and restores are yours to run, so a client's bad Tuesday does not have to become your Wednesday.
- Terms defined for the person who resells them
- What the client sees, noted on every entry
- Failure modes named, not glossed over
- Written by the people working the counter
Why Hosting Seller
On every plan, as standard
The request that actually works
Why a short, civil email from the client beats a technical one from you, and what to put in it.
Dates checked before they are promised
The 60-day lock and the expiry date, both public, both capable of moving a project plan you already agreed.
An exit worth being known for
Code issued the same day, nothing switched off mid-transfer, and a reputation you cannot buy any other way.
The white-label line drawn
Where a term can leak your supplier to an end client, the entry says so plainly rather than leaving you to find out.
Written peer to peer
No one is explained down to here. The entry assumes you know what a registrar is and tells you what it costs you.
Cross-linked, never siloed
The neighbouring terms are linked from every entry, so one lookup grows into a working grip on the whole area.
First Steps
From choosing to live
- 1
Check the lock and the expiry before quoting a date
A public lookup shows creation date, expiry and status codes. A name inside its 60-day lock is not moving, and finding that out after you promised is entirely avoidable.
- 2
Draft the release request for the client
Short, polite, from their address to the outgoing supplier, with a date in it. You are removing friction, not delegating the work.
- 3
Treat the code as spent once used
One code per move, never stored in a shared thread, regenerated rather than reused. It is a live credential until the transfer completes.
In the Box
Packed with every plan
- Lock status and expiry checked before any transfer date is agreed
- Auth codes kept out of shared tickets, spreadsheets and chat channels
- A domain free for year one when you order annually
- The renewal price printed on the tag matches the order price
- Site migration handled by our staff at no charge, on every account you bring
- Thirty days money-back on hosting plans, seven on reseller
- cPanel on every account — the panel a client's next developer already knows
- A free SSL certificate on every account, reissued before it lapses
- Nothing added at setup — no joining fee, ever
- Real people on the counter at any hour, including yours
Across the Counter
Things people ask us all the time
The client's previous agency will not release the auth code. What are my options?
Have the client request it in writing from the account holder, with a deadline. If that fails, accredited registrars must supply it within set timeframes for generic endings, and the registry or oversight body can be approached. Persistent stonewalling is itself the strongest argument for finishing the move.
Can I transfer a client's domain in without downtime?
Yes. A registrar transfer moves the registration, not the DNS, so as long as the nameservers and records stay the same throughout, the site and mail carry on. Do the transfer first and any hosting change second, so you never have two variables in flight at once.
Should I ask a client for their auth code up front?
Only when you are actually ready to transfer. Codes can expire or be regenerated, and holding one for weeks means holding a live credential for no reason. Ask when the work is scheduled, use it, and treat it as spent.
How quickly should I release a code when a client leaves?
The same day, with the name unlocked and a note saying nothing will be switched off while the transfer completes. It is ten minutes of work on an account you have already lost, and it is the version of your business other people will describe to their colleagues.
Read next
cPanel Reseller Hosting
The panel the trade already knows, sized for resellers, with WHM in the box and overselling switched on.
Domain Names
Search, register and transfer client names, with year one free when the hosting is ordered annually.
Moving your site to another host? Start with this checklist.
A step-by-step order of work for a move your visitors never spot: which files to copy first, how to carry email across without losing one message, the right moment to repoint DNS, and the two mistakes behind nearly every hour of downtime people ring us about.
Put your logo on the panel, not ours.
Private nameservers, a panel carrying your logo, overselling switched on, and renewals charged at the order price. Real people on the counter at any hour.
See Domain Names plans