GST Portal OTP Goes to the Owner and the Accountant Is Stuck: Setting Up Access Properly
GST portal login OTPs go to the primary authorised signatory, and e-way bill and e-invoice portals require multi-factor login for all taxpayers since 1 April 2025. Make a finance manager the primary signatory with a company number, engage your accountant as a GST practitioner, and create separate sub-users for dispatch staff.
It is the 20th, GSTR-3B is due, and the accountant is waiting for an OTP that has gone to the owner's phone. The owner is travelling. This happens in thousands of small businesses every month, and it is avoidable.
Why it happens
- ✓GST portal. After you enter the username and password, the portal sends an OTP to the mobile number and email of the primary authorised signatory. The OTP expires in 10 minutes.
- ✓E-way bill and e-invoice portals. Multi-factor login became compulsory in stages, and from 1 April 2025 for all taxpayers. The OTP goes to the registered mobile number, or through the Sandes app.
If the registered number belongs to one person, every login depends on that person.
The right set-up
| Need | Set-up |
|---|---|
| A finance manager who files returns | Add them as an authorised signatory, with a board resolution or letter of authority |
| An outside accountant or tax practitioner | Engage them as your GST practitioner on the portal; they prepare returns under their own login and you approve the final filing |
| Staff who generate e-way bills or e-invoices | Create sub-users on the e-way bill and e-invoice portals, each with their own login and rights |
| Owner's number is old or lost | Update the authorised signatory's mobile and email through a non-core amendment |
To add an authorised signatory: log in, go to Services, Registration, Amendment of Registration Non-core Fields, open the authorised signatory tab and choose "Add new". You can then choose who is the primary signatory, and the OTP goes to that person.
A worked example
A Nagpur distributor had one login, with OTPs going to the founder. The firm made the finance manager the primary authorised signatory, kept the founder as a second signatory, engaged its CA firm as GST practitioner and created two e-way bill sub-users for the dispatch desk. Filing no longer stops when one person is away.
Good practice
- ✓Use a company-owned mobile number for the primary signatory, not a personal one.
- ✓Never share the password with suppliers or outside staff. Practitioners and sub-users have their own logins for a reason.
- ✓Remove signatories and sub-users the day someone leaves.
- ✓Keep the registered email in a shared mailbox that more than one person can read.
Frequently asked questions
Can I switch two-factor login off?
No. It is part of the portal's security for all taxpayers.
Does a GST practitioner have full access?
No. A practitioner can prepare and save returns, but the taxpayer has to confirm the final submission.
Is the e-way bill password the same as the GST portal password?
No. They are separate systems with separate logins, and sub-users are created on each.
Sources
- ✓Advisory on updates to e-way bill and e-invoice systems, Maharashtra GST
- ✓How to enable multi-factor authentication on the GST portal, Tally
- ✓FAQ on accessing the GST portal, Delhi Trade and Taxes
This is a summary, not legal advice. Confirm with your chartered accountant before you rely on it.
Written by
Founder, Airwix Technologies (Sleet)
Vatsal Sutariya is the founder of Airwix Technologies in Ahmedabad, the company that builds Sleet: SleetHR for HR and payroll, and Sleet Accounting for GST billing and books. He writes about GST, invoicing, business tax and choosing software for Indian businesses, and checks each rule against the official notification before it is published.
LinkedIn profile →