The Auth code:(.*)</div> pattern matches Auth code: literal substring, then matches and captures into Group 1 any 0+ chars other than line break chars, as many as possible as the * is a greedy quantifier, and then matches </div>, an obligatory literal substring.
If you replace .* with .*? (a lazy version), you still won't get the result you need because there is a space after :, and \W matches a space. So, .*? will match an empty string between : and the space.
The best way to get the substring you need is to add \s* (any 0+ whitespaces) after : and then use a match reset operator \K that omits the text matched so far, and match 1 or more word chars (it is much more efficient than match any chars lazily up to the first non-word char):
~Auth code:\s*\K\w+~
Details:
Auth code: - a literal substring
\s* - 0+ whitespaces
\K - a match reset operator
\w+ - 1 or more word chars
See the PHP demo online:
$my_string = 'Auth code: 02452A</div>';
preg_match("~Auth code:\s*\K\w+~",$my_string, $m);
print_r($m[0]); // => 02452A