Compliance & accounting
The monthly filing cycle, without the monthly signing-in.
Statutory portals are the purest form of this problem: the work is identical every month, the deadline is non‑negotiable, and the government has no incentive to build an API for the few thousand firms that would use one.
Four portals, eleven logins, one afternoon
-
Sign in to the GST portal
Username, password, OTP to the registered mobile. Sometimes a digital signature certificate on a token. Repeat for every GSTIN the firm manages, a CA with forty clients does this forty times.
-
Download what the counterparties filed
GSTR-2B, and GSTR-2A if anyone still wants it. Also the inward supply statement, ITC availability, and any amendments filed late by a vendor who had until the 20th.
-
Reconcile against the purchase register
Match every invoice in the books to an invoice in 2B. Chase the ones that are missing. This is the part that actually takes the afternoon, and it happens after the login.
-
File, pay, and prove it
GSTR-1 and GSTR-3B, then generate the challan, then come back later to download the payment receipt, because the portal will not show it in the same session.
-
Repeat across the other portals
Income tax for 26AS and AIS. MCA for annual filings. EPFO for the monthly ECR. State portals for professional tax and VAT. Different logins, different session rules, same afternoon.
The login happens once. The cycle runs itself.
- Pull GSTR-2B per GSTIN on the day it is generated, for every client, in parallel.
- Download 26AS, AIS and TDS statements from the income tax portal on a schedule.
- Fetch MCA filing status and annual return acknowledgements.
- Retrieve EPFO challans and the monthly ECR confirmation.
- Download payment receipts hours after filing, in a separate run, without anyone remembering to.
- Assert before scraping: if the portal silently returned a login page, the run fails loudly instead of producing an empty reconciliation.
The gain is not the clicking. It is that nobody has to be at a desk when the data appears, and nobody forgets.
The specifics that matter here
Digital signature certificates
DSC tokens are the awkward part of Indian statutory filing. We do not emulate a hardware token. Where a DSC is required, the capture happens on the machine that has it, and subsequent runs that do not need re-signing proceed unattended. Where a portal requires a fresh signature on every filing, we’ll tell you that workflow is not a fit rather than sell you a pilot.
Many clients, one firm
This is where session replay pays for itself. A CA firm manages dozens of GSTINs, each with its own portal login. With credential replay you would be solving an OTP per client per month. With sessions, you capture each client once and then run the whole book in parallel.
Government portals are hostile to bots, deliberately
Rate limits, session timeouts, CAPTCHA on repeated access, and IP reputation checks. Because we replay a session the portal already granted, runs look like a normal signed-in user rather than a login attempt, which is the pattern those defences are actually looking for.
The honest failure mode
Some state portals expire sessions in under an hour and require OTP on every entry. For those, the honest answer is that automation reduces the work rather than removing it. We will identify which of your portals behave this way in the first week of a pilot.
Run it on one GSTIN first.
Thirty days, one portal, one workflow. You’ll know by the next filing cycle.