auth code (EPP code).

The auth code is the credential that makes a registrar transfer possible. It belongs to the domain rather than to your account, so a portfolio of thirty names has thirty different codes. You obtain it from the registrar you are leaving, give it to the registrar you are joining, and their transfer request is accepted by the registry only if the code matches.

Getting one is normally self-service: somewhere in the domain's settings there is a button, and the code is either shown on screen or emailed to the registrant address on file. Registrars are obliged to provide it on request and are not permitted to withhold it to keep your business, so a registrar that makes it hard is being obstructive rather than exercising a right. Codes are increasingly time-limited under ICANN's revised transfer rules, so request one when you are ready to move rather than filing it away for later — an old code may simply have expired.

Treat it as a password, because that is exactly what it is. Anyone holding a valid auth code for an unlocked domain can initiate a transfer away from you, and by the time you notice, the domain and its DNS may be somewhere else. Do not paste it into a support chat with a third party, do not leave it in a shared document, and regenerate it if you think it has leaked. The registrar lock is the second factor here: with the lock on, a leaked code alone is not enough.

In practice a transfer needs four things lined up: the domain unlocked, a current auth code, an administrative contact address you can actually read (the approval email goes there), and a domain outside its 60-day transfer lock. Some registrars also want WHOIS privacy switched off first. Get those right and the rest is waiting. If you are moving to save money, work out the destination first with the price comparison.