How to Enable API Access in the GST Portal (Step by Step)

"Enable API access on the GST portal" is one of those instructions that arrives without context — usually from an accounting vendor's onboarding email, usually with a deadline attached. It takes about ninety seconds to do. The part worth understanding is what you are switching on, because a large share of the people searching for this setting do not need it at all, and a smaller share turn it on and then forget it expires.

What "enable API access" actually means

The GST system exposes APIs for the operations that touch a specific taxpayer's own records — filing returns, reading ledgers, creating challans, amending registration details. Because those operations read and write your data, GSTN requires you to explicitly authorise them before any software can perform them on your behalf.

The Manage API Access toggle is that authorisation. Switching it on tells GSTN that, for a defined window, requests arriving through a GST Suvidha Provider and carrying your credentials may operate against your registration. Your accounting software, your CA's filing platform, your ERP's GST module — all of them depend on it being on.

First: check whether you need it at all

Before you change any setting, confirm you are solving the right problem. This one question separates the two groups who land on this page:

The bottom three rows are where most of the confusion sits. Checking somebody else's GST number reads the public registration record, which is published precisely so counterparties can verify each other. It needs no portal setting, no consent, and no involvement from the business you are checking — they never even know you looked. The distinction is covered in full in validation vs verification.

Enabling it, step by step

You will need the GST portal login for the registration in question — username and password for the primary authorised signatory. A sub-user account may not show the option.

1. Sign in to the GST portal. Go to gst.gov.in and log in with the credentials for the GSTIN you want to enable.
2. Open My Profile. Select your username in the top-right corner of the dashboard, then choose My Profile. This is the step people miss — the setting is not on the dashboard itself.
3. Select Manage API Access. On the profile page, find the Quick Links panel on the left and choose Manage API Access.
4. Switch API Request to Yes. The default is No. Changing it to Yes reveals a duration selector.
5. Choose a duration. Pick how long access should remain enabled. Thirty days is the usual default and the usual choice.
6. Confirm. Save the change. It takes effect immediately — there is no waiting period and no email confirmation step.

How long access stays on

The duration you picked is a hard window, and when it closes the setting reverts to No without warning. Nothing emails you. Your filing software simply starts failing authentication, usually with an unhelpful error, and usually on the day you needed it.

This is the single most common GST API support ticket, and it has a boring fix: put a calendar reminder three days before expiry on every GSTIN you have enabled. If you manage registrations for clients, track expiry dates alongside filing deadlines rather than discovering them together. Teams running multi-client platforms should read GST API access for CA firms, which covers managing this across a book of clients without a spreadsheet of expiry dates.

Turning it off again

The same path in reverse: My Profile → Manage API Access → API Request → No → Confirm. It takes effect immediately and any software relying on it stops working at once.

Worth doing when you stop using a product, change vendors, or end an engagement with a CA firm. Revoking is the clean way to end that access — far better than changing your portal password, which breaks more than you intended and tends to generate its own support thread.

When the toggle misbehaves

If your software reports an error rather than silently failing, the error code usually says more than the portal does. Our GST API error codes guide decodes the ones that come back from GSTN, including the authentication failures that mean exactly this setting has lapsed.

What you are agreeing to

This is a real grant of access to your tax records, and it deserves the same care as any other credential decision — not alarm, but not an unthinking click either.

While it is on, licensed software carrying your credentials can read your returns, ledgers and liabilities, and file on your behalf. That is the intended purpose; it is how every GST accounting product works. But three habits are worth adopting: enable it when you are actively using a product rather than leaving it permanently on, prefer shorter durations and renew deliberately, and revoke when an engagement ends rather than letting it lapse on its own.

Note also what it does not expose. Enabling API access does not make your data public and does not change what anyone can see about you in a GSTIN lookup. Your legal name, trade name, registration status, constitution, jurisdiction and filing history were already public and remain exactly as visible as before — that is a separate category of data entirely, explained in the GST developer portal guide. If you are curious what counterparties can already see about your business, run your own GSTIN through the free lookup and look at the result.

Frequently asked questions