The authorization code (aka 'auth code') is the registrant’s password for their domain name, which is used to complete change of registrar for the domain. The code is generated by the registrar on the registrant’s request. The registrar is obligated to produce an authorization code for every domain name that the registrar administers at any time on the request of the registrant.
The code that is generated by the registrar must be at least nine characters, of which one character must be a lowercase letter, one uppercase letter, one special character and one digit. Besides this, the registrar is free to specify the code. After use, the code is forfeit.
A common procedure is to allow the user to generate the code by clicking on a button in the registrars control panel. Offering this function in a control panel also resolves the issue of authentication and ensuring that only the registrant has access to it.
The code is then updated at the Registry level when the registrar executes the “domain update” command. After change of registrar, the code is reset at the Registry.