iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Integrating HMRC APIs is a regulated software project, not simply a matter of adding an HTTP client. Choose the relevant tax service, keep HMRC calls on your server, use OAuth 2.0 delegated access, preserve legally required digital records and links, send compliant fraud-prevention headers where required, and prove every supported journey in the sandbox before requesting production access. Teams that do not want to own that work can instead use HMRC-compatible accounting software or bridging software.
Choose the integration route before writing code
Your first decision is who owns the ledger, tax workflow and HMRC maintenance. HMRC treats VAT, Income Tax and Corporation Tax as separate API families, so a product that files VAT is not automatically suitable for Income Tax or Corporation Tax.
| Route | Best fit | Strengths | Trade-offs |
|---|---|---|---|
| Direct HMRC APIs | A product team that owns the ledger and tax workflow | Full control of data, user experience and automation; can support a broad set of HMRC journeys | You own OAuth, fraud-prevention headers, testing evidence, production approval, security and ongoing API-version maintenance |
| HMRC-compatible accounting software | Small businesses and practices wanting a supported filing product | Digital-record features, filing workflows and vendor-managed HMRC changes are already packaged | Subscription cost, vendor limits and less control over the underlying data model and release schedule |
| Bridging software | An organisation that wants to keep an existing spreadsheet or ledger | Preserves current bookkeeping and adds a compliant submission connection with less migration | You must design compliant digital links, accept a narrower workflow and depend on the bridge covering the required HMRC service |
For a purchased product, verify its current status in HMRC’s Software Choices directory immediately before signing up. Minimum functionality and listing status can change; VAT products are added after production approval and a live submission.
Know which HMRC API family you need
VAT Making Tax Digital
The VAT family covers more than posting a return. A complete implementation normally retrieves obligations, submits VAT returns, retrieves liabilities and payments, and supports penalties, interest, appeals or close-down activities where those journeys apply. VAT filing frequency may be annual, quarterly or monthly; Making Tax Digital does not alter the frequency set for the business.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Income Tax Making Tax Digital
Income Tax MTD is organised around Business Details, Obligations, Self-Employment Business and/or Property Business, and Individual Calculations when your software displays calculations. For each mandated income source, your product must maintain or connect to digital records and submit quarterly updates. It must also provide an income-tax estimate or clearly signpost where the user can obtain one. The taxpayer remains responsible for the accuracy of data submitted.
Corporation Tax
HMRC’s catalogue identifies a Corporation Tax API for submitting or amending a CT600 return. Confirm the current API version and whether production access is available before committing Corporation Tax to a roadmap; catalogue entries and availability are subject to change.
Agent workflows
Accountants and other agents need delegated authority rather than a client’s login details. The Agent Authorisation API supports requesting, checking, cancelling and ending client relationships. Income Tax journeys can distinguish a main agent from a supporting agent, so model those permissions explicitly instead of assuming every authorised user has identical access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare the people, accounts and environments
HMRC’s Developer Hub onboarding sequence is designed to separate experimentation from live taxpayer data:
- Create a Developer Hub account for the organisation and identify the service owner responsible for HMRC compliance.
- Create a sandbox application and select the exact APIs and scopes you intend to call.
- Obtain sandbox credentials, build the integration and record test evidence for every endpoint and error path you claim to support.
- Create a production application only after the tested feature set is stable.
- Accept HMRC’s terms, submit the requested testing evidence and approval materials, and wait for production credentials.
Use separate credentials, secrets and configuration for sandbox and production. Never place a production secret in a browser bundle, mobile application or source-control repository.
Use a server-side architecture
HMRC states that its API platform does not support cross-origin resource sharing (CORS). Browser JavaScript therefore cannot call HMRC APIs directly. Put HMRC traffic behind a backend service that can protect credentials, validate callbacks, encrypt tokens and apply consistent logging and retry rules.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
HMRC also does not support software that automatically drives the OAuth grant web interface. Your application should launch HMRC’s consent journey and let the customer or agent sign in and approve access directly on HMRC’s site. Do not scrape, replay or automate the Government Gateway login page, and never ask users to give your product their Government Gateway password.
Implement OAuth 2.0 and delegated authority safely
Customer consent flow
- Generate a state value and a one-time authorisation request on your server.
- Redirect the customer to HMRC’s OAuth 2.0 consent journey with only the scopes needed for the selected API family.
- After consent, validate the callback state, issuer and redirect URI before exchanging the authorisation code.
- Store the returned access and refresh tokens encrypted, associated with the correct business or agent relationship.
- Use the access token for API calls, refresh it securely when necessary, and record consent time, granted scopes, token status and revocation events for audit.
Tokens are specific to the business or agent that authorised the connection. A second business must complete its own consent journey; copying a token between tenants is both incorrect and a security defect.
Agent consent and relationship changes
Use agent-services credentials for agent operations and the Agent Authorisation API to establish and monitor each client relationship. Handle cancellations, expiries and ended relationships as first-class states. When HMRC indicates that authority is absent or has changed, stop filing for that client and present a re-authorisation action rather than retrying indefinitely.
Design records and mappings for auditability
Build a durable mapping layer between your ledger’s categories and HMRC fields. Avoid embedding HMRC field names throughout business logic; version the mapping so a tax-year or API-version change can be reviewed and migrated deliberately.
For every submission or calculation, preserve:
- Original source transactions and the user or import process that created them.
- Amendments, reversals and the reason each change was made.
- HMRC request and response identifiers, HTTP status and timestamps.
- Tax year, obligation period, business ID and, where relevant, calculation ID.
- The user’s consent record, granted scopes and agent relationship at the time of the call.
- The exact payload or a tamper-evident representation sufficient to reconstruct what was submitted.
Income Tax MTD requires legally compliant digital records. If a spreadsheet, bookkeeping system and submission service are separate products, maintain the digital links between them so values can move electronically without being retyped or manually transcribed. A bridge that merely accepts a re-keyed total may not satisfy that requirement.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Build the minimum compliant journeys
Income Tax MTD implementation
Start by obtaining the relevant business identifiers and obligations. For each self-employment or property business, connect the ledger to the required digital-record fields, calculate the period totals, and submit quarterly updates for the obligation period shown by HMRC. If your interface shows an estimate, label it as an estimate and retain the calculation identifier when HMRC supplies one.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Every Income Tax MTD request must include compliant transaction-monitoring fraud-prevention header data. HMRC describes this header information as a legal requirement for software using the Income Tax APIs. Treat missing, malformed or inconsistent headers as release-blocking failures, not optional telemetry.
VAT implementation
A useful VAT workflow normally follows this order:
- Retrieve the business’s obligations and identify the open period.
- Load the ledger values required for the VAT return and show the user exactly which period is being prepared.
- Validate totals, scheme rules and duplicate-submission safeguards before sending.
- Submit the return and store HMRC’s response identifiers and accepted period.
- Retrieve liabilities and payments so the user can reconcile what HMRC expects with what has been paid.
- Expose penalties, interest, appeal or close-down actions where your product claims to support them.
Do not assume that a successful return submission proves the whole VAT journey is covered. Obligations, liabilities, payments and penalty states need their own endpoint tests and user-interface states.
Corporation Tax implementation
For CT600 submission or amendment, confirm the production status and current version in HMRC’s API catalogue first. Keep the return period, company identity, submission status and amendment history separate in your data model so an amended return cannot overwrite the original audit trail.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDesign fraud-prevention headers and observability
Fraud-prevention data is part of the Income Tax contract. Capture the transaction-monitoring values your application can legitimately provide, send them in the required headers, and log the values or a protected fingerprint according to your privacy policy. Your logs should allow an investigator to connect a rejected request to the application session, user, business, endpoint and payload without exposing secrets.
Build an operational view that shows authorisation failures, expired tokens, rejected headers, validation errors, duplicate attempts, throttling responses and HMRC correlation identifiers. Give users a clear state such as “awaiting re-authorisation” or “retry scheduled”; do not display a generic “HMRC error” when the next action is known.
Test in the sandbox before requesting production access
Test every endpoint your product advertises, not only the happy path. Include:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Valid and invalid field values, missing mandatory data and boundary amounts.
- Unauthorised, expired-token and insufficient-scope responses.
- Duplicate submissions, amendments and out-of-period requests.
- Customer and agent journeys, including ended or missing authority.
- Throttling and transient server failures.
- VAT obligations, liabilities, payments and penalty-related states where supported.
- Income Tax obligations, business records, quarterly updates and calculation displays where supported.
Income Tax sandbox scenarios may be dynamic or stateful. HMRC retains submitted stateful test data for seven days before deleting it, so make test scripts reproducible and reseed data when a scenario expires. Keep an evidence log containing the scenario, request date, endpoint, response, expected result, application version and tester.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
HMRC requires compliant fraud-prevention headers in sandbox calls and checks the logs. A test run that omits those headers is not evidence that the production implementation is compliant.
Request production approval
- Freeze the endpoint set and application version represented by your evidence.
- Run the complete sandbox suite again, including fraud-prevention, agent, amendment and throttling cases.
- Provide HMRC with the sandbox application details and complete the Production Approvals Checklist.
- Ensure the checklist, test evidence and requested production scopes describe the same product; approval materials that do not match the tested feature set create avoidable delays.
- After satisfactory review, configure the issued production credentials in the protected production environment and perform a controlled live smoke test.
The Developer Hub’s current onboarding guidance says production application review can take up to 10 working days. Plan that lead time, and do not promise a customer launch date that depends on approval arriving earlier.
Separate sandbox and production operations
Use HMRC’s sandbox base URL https://test-api.service.hmrc.gov.uk for test calls and the production base URL https://api.service.hmrc.gov.uk for live calls. Keep the base URL in environment configuration so code cannot accidentally send test credentials to production or live credentials to the sandbox.
For reliability:
- Retry only errors that are safe to retry, with exponential backoff and a maximum attempt count.
- Handle HTTP 429 responses using bounded delays and a user-visible pending state.
- Use idempotency safeguards and a submission ledger so a network timeout cannot cause a second filing.
- Persist the request state before sending and reconcile ambiguous outcomes by querying the relevant HMRC resource.
- Alert on rising rejection, authorisation and throttling rates rather than waiting for users to report them.
Plan for HMRC change
Pin the API versions you use and monitor HMRC’s API changelog. HMRC advises that breaking changes receive six months’ notice before production where possible and recommends running automated tests against the sandbox weekly. Treat that notice as planning time, not as permission to postpone migration until the retirement date.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA practical release process includes a weekly sandbox run, dependency review, contract-test reports, a version-support matrix and an owner for each HMRC endpoint. When a version changes, compare field mappings, fraud headers, validation rules and error responses before promoting the new version.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Security and data-protection checklist
- Keep OAuth client secrets and refresh tokens in a managed secret store, encrypted at rest and inaccessible to front-end code.
- Validate OAuth callbacks, use one-time state values and restrict redirect URIs.
- Apply least-privilege scopes and record why each scope is needed.
- Rotate credentials and revoke tokens when an account is disconnected, an employee leaves or an agent relationship ends.
- Limit sensitive data in logs; protect HMRC identifiers and payloads with access controls and retention rules.
- Use role-based permissions so bookkeeping staff, approvers and agents cannot all perform the same actions.
- Give users an exportable audit history showing who connected an account, what was submitted and when.
Troubleshoot common integration failures
“The browser call is blocked”
This is expected when a front end attempts a direct HMRC request because CORS is not supported. Move the call to your backend and have the browser communicate only with your own server.
“OAuth works for me but not for a client”
Check that the client completed the consent journey, that the requested scopes match the endpoint, and that the stored token is associated with the correct business or agent relationship. Never substitute a developer’s token or collect the client’s Government Gateway password.
“Income Tax requests are rejected even though the values are correct”
Inspect fraud-prevention headers, business IDs, obligation periods and the exact API version. A valid-looking payload does not compensate for missing mandatory headers or an identifier from another business.
“A submission timed out and the user clicked Submit again”
Mark the first attempt as ambiguous, retain its request identifier and query HMRC before allowing another submission. Idempotency controls should make the safe action the default.
“The product passed basic tests but approval is delayed”
Compare the Production Approvals Checklist with the evidence and requested scopes. Missing agent, amendment, throttling or fraud-header tests, or a mismatch between the tested build and the approval application, can prevent satisfactory review.
Make the buy-versus-build decision explicit
Choose direct APIs when you need ownership of the ledger, a differentiated workflow or automation that existing products cannot provide, and have a team to maintain compliance and HMRC changes. Choose compatible accounting software when filing, digital records and vendor maintenance matter more than controlling the data model. Choose bridging when the existing spreadsheet or ledger is valuable and the required submission can be supported without breaking digital-link requirements.
Whichever route you choose, verify that it supports the exact tax service, periods, agent roles and post-submission tasks your users need. A product that submits one VAT return may not retrieve liabilities; a bridge that sends a total may not preserve the digital links required for Income Tax MTD.
Recommended Free Tools
Official statements that define the implementation
- HMRC Developer Hub: “It is a legal requirement for software to provide compliant fraud prevention header information for all Making Tax Digital for Income Tax APIs.”
- HMRC Developer Hub: “The HMRC API Platform does not support cross-origin resource sharing (CORS).”
- HMRC Developer Hub: “We use the open standard OAuth 2.0”.
These statements translate into concrete engineering requirements: server-side HMRC calls, a user-driven OAuth consent flow and release-gated fraud-prevention support.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
