Why it matters
The auth code is the key a seller hands over, directly or through escrow, so the buyer's registrar can pull the domain. The code is tied to the domain and should be treated like a password. Domains must be unlocked first, and a new registration or recent transfer may still be locked. A common mistake is sending the code in an open email before payment is secured. Send it only when the buyer's funds are held in escrow. Some codes expire, so request a fresh one if the transfer stalls. Owners can usually get the code from their registrar account.
Source: icann.org
Read nextHow Domain Transfers Work: Auth Codes, Transfer Locks, and Push vs Transfer