To get HMRC agent authorisation, use the route that matches each tax. The digital handshake from your agent services account covers VAT, Making Tax Digital for Income Tax and some other services, with a request link that expires after 21 days. Online Agent Authorisation covers Self Assessment, Corporation Tax and PAYE, with a postal code the client must pass back, usually within 30 days.
Key takeaways
- Different taxes use different routes: the digital handshake, Online Agent Authorisation, the client's business tax account or form 64-8.
- Digital handshake links expire after 21 days; postal codes arrive within 7 working days and usually expire 30 days after issue.
- Start authorisation on the day the engagement letter is signed, not when the work is due.
- Track every request with a date and a chase schedule, because expiry means starting again.
- Never use a client's own HMRC sign-in details to act for them.
Why does HMRC agent authorisation cause so many delays?
Most practices know the theory. The trouble is practical: HMRC has several authorisation routes, each covering different taxes, using different accounts, and each with its own timings. A new client who needs Self Assessment, VAT and PAYE can involve three separate processes.
Delays usually come from four places. The firm starts too late, often when the return is already due. The client ignores a request link or loses a letter with the code. The request expires and has to begin again. Or the firm sends the request from the wrong account and the client hits an error.
The fix is to treat authorisation as part of onboarding, with its own checklist and deadlines, rather than an admin task that happens whenever someone remembers. This guide sets out the routes as HMRC describes them, then a workflow that ties them together.
HMRC's main guide, how to get authorised to act as a tax agent, was last updated on 7 October 2026. Check it before relying on any detail, because services move between routes over time.
Which HMRC authorisation route covers which tax?
You must already be registered as a tax agent before you can ask clients to authorise you. After that, the route depends on the service. Here is a summary based on HMRC's guidance.
| Route | Examples of services covered | What the client does | Timing to plan for |
|---|---|---|---|
| Digital handshake (agent services account) | VAT, Making Tax Digital for Income Tax, Capital Gains Tax on UK property, Trust Registration Service | Opens your link and signs in with the details they use for that tax | Link expires after 21 days |
| Online Agent Authorisation (HMRC online services for agents) | Self Assessment, Corporation Tax, PAYE, CIS | Receives a code by post and gives it to you | Letter within 7 working days; code usually expires 30 days after issue |
| Client's business tax account | Some services, including CIS and PAYE | Adds you using your agent identifier | Depends on the client |
| Form 64-8 (paper) | Corporation Tax, Self Assessment, PAYE, individual PAYE or NI, VAT (legacy) | Signs the paper form | Postal processing |
For Making Tax Digital for Income Tax, HMRC says you can use the digital handshake or copy existing Self Assessment authorisations from your HMRC online services account into your agent services account. There's no paper route for it.
How does the digital handshake work?
HMRC's guide to using the digital handshake sets out the steps:
- Sign in to your agent services account. HMRC says you can't use your HMRC online services sign-in for this.
- Select Ask a client to authorise you.
- Enter the client's details, which depend on the tax service and can include their National Insurance number, date of birth and tax reference.
- Copy the authorisation request link from the final page and send it to the client.
The client signs in with the details they used to register for that tax service, or creates them if they have none. HMRC says the link expires after 21 days, and if it does you must start again. You can see each request's status on the Manage your authorisation requests from the last 30 days page.
Two practical points. First, send the link with a short explanation of what it is, so clients don't mistake it for a phishing email. Second, note the date you created it, because the 21-day clock is the one that catches firms out.
How does Online Agent Authorisation work?
For Self Assessment, Corporation Tax and PAYE, HMRC's Online Agent Authorisation guide describes a two-stage process using your HMRC online services for agents account.
First, you request the authorisation: sign in, choose Authorise client, then Request an authorisation, pick the tax service and enter the client's details. HMRC then posts a letter with an authorisation code to the client within 7 working days.
Second, the client gives you the code, and you enter it under Enter authorisation code. HMRC says the client should give you the code usually within 30 days of the letter being issued, with the exact date shown in the letter. After that the code expires. Enter it wrongly three times and you also have to start again.
The weak point is the post. Letters get filed, lost or opened by someone else in the household. Tell the client in advance that a letter is coming, what it will look like, and exactly how to send you the code.
What does a reliable authorisation workflow look like?
Here's a sequence that fits most practices. It starts the day the client signs your engagement letter, which our guide to engagement letters for accountants covers in more detail.
- Day 0: identify the services. List every tax you'll act on and match each to its route using the table above.
- Day 0: collect the details. Ask for the identifiers each route needs, such as UTR, National Insurance number, VAT number and PAYE reference, through a secure form rather than email.
- Day 1: send every request at once. Create digital handshake links and Online Agent Authorisation requests together, and tell the client what to expect: a link by email today and a letter by post within about a week.
- Day 7: first chase. Check the status page and remind the client of any link not yet accepted.
- Day 10: letter check. Ask whether the code letter has arrived and remind them how to send the code.
- Day 16: final chase for any digital handshake link, before it expires at 21 days.
- Day 25: code deadline warning for any outstanding postal code.
- On completion: record the date each authorisation went live on the client record.
If anything expires, restart immediately and restart the chase schedule with it. Write the dates down; don't rely on memory.
How much time does a weak process cost?
Here's an illustrative example with made-up figures. A practice takes on 40 new Self Assessment clients in November ahead of the Self Assessment deadlines. Without a set workflow, it sends authorisation requests when each job starts and chases only when it notices.
Suppose a quarter of the codes, 10 clients, expire or go missing. Each restart costs about 20 minutes of staff time plus another postal cycle of up to two weeks. That's 200 minutes of rework and, more importantly, 10 clients who can't be discussed with HMRC for an extra fortnight in December or January.
Now compare the workflow above. Requests go out on day 1 and are chased on fixed dates. If that cuts expiries to 3 clients, rework falls to 60 minutes, and the delays happen in November when there's time to absorb them.
The saving in minutes is modest. The real gain is that authorisation never becomes the reason a January return can't be finished.
What about clients who struggle with online authorisation?
Some clients can't or won't use online services. HMRC's guidance offers two ways round this.
For the digital handshake, HMRC says you can give digitally excluded clients the authorisation request link and a number to contact HMRC. They are passed to HMRC's Extra Support Team, who talk them through the process by phone.
For services with a paper option, form 64-8 remains available for Corporation Tax, Self Assessment, PAYE, individual PAYE or National Insurance, and VAT (legacy). It's slower, but it works for clients who will never sign in online.
One rule applies in every case: HMRC says you should not use your client's HMRC sign-in details or access their online tax account. It can be tempting when a client offers their password to save time, but it isn't an authorisation and leaves the practice exposed.
Also remember that some authorisations are narrower than they look. HMRC notes that the Income Record Viewer only lets you view income data; it doesn't authorise you to speak to HMRC for the client.
How do you keep authorisations up to date?
Authorisation isn't a one-off. Clients can remove an agent, and a new agent appointed for the same service replaces the old one. A client who briefly switches to another firm and comes back may need to authorise you again.
Build three checks into your year:
- At each engagement renewal, confirm that every service you act on still shows as authorised.
- When a client adds a tax, such as registering for VAT or starting MTD for Income Tax, start the right authorisation the same week.
- When a client leaves, record the date and close the job, so nobody keeps chasing HMRC for someone you no longer represent.
Keeping a simple record of service, route, date requested and date live on each client file makes these checks quick.
How Zaquil handles HMRC agent authorisation onboarding
Zaquil doesn't connect to HMRC or submit authorisations for you; those steps happen in your agent services account and HMRC online services. What it does is run the onboarding around them, so nothing slips.
A secure place for client details. The client fills in an onboarding questionnaire in a branded secure client portal, giving their UTR, NI number, VAT and PAYE references without sending them by email. The firm sees the answers on the client record.
An onboarding job with a checklist. Each new client gets a job from a template, with a line for every authorisation: route, date requested and date live. It sits on a kanban board with an owner and a deadline.
Automated chasers on the right dates. Automations send the day 7, 10, 16 and 25 reminders, ask whether the code letter has arrived, and create a task for staff when an expiry is close.
One inbox for replies. When the client replies by email, SMS or WhatsApp with their code, it lands in one shared inbox attached to their record, not in a colleague's personal mailbox.
Engagement and billing together. The engagement letter is e-signed in the portal with a signed PDF certificate, and recurring jobs and invoices are set up once.
See how this works on our accounting and tax solution page, or check Zaquil pricing: plans from $19 a month with a 14-day free trial and no credit card to start.
Frequently asked questions
How do I get authorised as a tax agent with HMRC?
First register as a tax agent. Then ask each client to authorise you using the route for each tax: the digital handshake from your agent services account for services such as VAT and MTD for Income Tax, Online Agent Authorisation for Self Assessment, Corporation Tax and PAYE, the client's business tax account, or form 64-8 on paper.
How long does an HMRC digital handshake link last?
HMRC says the authorisation request link expires after 21 days. If the client hasn't responded by then, you must start the process again. You can check each request's status on the Manage your authorisation requests from the last 30 days page in your agent services account.
How long does an HMRC agent authorisation code take to arrive?
For Online Agent Authorisation, HMRC sends the client a letter with the code within 7 working days of your request. The client should give you the code usually within 30 days of the letter being issued; the exact date is printed in the letter. After that the code expires.
What happens if an agent authorisation code expires?
You have to start the request again from your HMRC online services for agents account, and HMRC will post a new letter. The same applies if you enter a code incorrectly three times. Tell the client a fresh letter is coming, so they don't send you the old code.
Can I still use form 64-8 to get authorised?
Yes, for some services. HMRC lists form 64-8 as a paper option for Corporation Tax, Self Assessment, PAYE, individual PAYE or National Insurance, and VAT (legacy). It isn't available for Making Tax Digital for Income Tax, which uses the digital handshake or copied Self Assessment authorisations.
How do I get authorised for Making Tax Digital for Income Tax?
HMRC says you can use the digital handshake from your agent services account, or add existing Self Assessment authorisations from your HMRC online services account to your agent services account. There is no paper route for MTD for Income Tax, so start early with clients who will need it.
Which account do I use for the digital handshake?
Your agent services account. HMRC says you can't use your HMRC online services sign-in for the digital handshake. Sending a request from the wrong account is a common reason clients see an error, so check which account you're in before creating the link.
Can I use my client's Government Gateway login to file for them?
No. HMRC says agents should not use a client's HMRC sign-in details or access their online tax account. Using a client's login is not an authorisation and leaves the practice exposed. Get authorised through one of HMRC's agent routes instead.
What can digitally excluded clients do?
HMRC says you can give digitally excluded clients the authorisation request link and a number to contact HMRC. They are passed to HMRC's Extra Support Team, who talk them through the process by phone. For some services, form 64-8 on paper is another option.
Does the Income Record Viewer let me speak to HMRC for a client?
No. HMRC notes that authorisation for the Income Record Viewer through the digital handshake only lets you view income data. To speak to HMRC on the client's behalf, you still need authorisation through form 64-8 or Online Agent Authorisation. Check the scope of each authorisation before you call.
When should I start HMRC agent authorisation for a new client?
On the day the client signs your engagement letter. Send every request at once, warn the client that a link and a letter are coming, and chase on fixed dates. Starting when the return is due risks expired codes and delays at the busiest time of year.
What happens to my authorisation if the client appoints another agent?
A new agent appointed for the same service replaces the previous one, and clients can remove an agent at any time. If a client returns after using another firm, check your authorisation status and request it again if needed before you contact HMRC for them.
Run this part of your business in one place
Zaquil puts every email, document, approval, invoice, call and automation for your accounting and tax solution page in a single workspace — set up for UK practices on day one.
- Client portal with document requests, organisers, e-signatures and online payment
- Jobs with templates, checklists and recurring work; invoices and unbilled time
- One inbox for email, chat, SMS, WhatsApp and calls across every brand