PAN-Linked GSTIN Discovery and Verification for Merchant Onboarding

Because PAN is verified at the very start of onboarding, GST verification reuses it. When a merchant confirms they are a GST holder and ticks the consent checkbox, the backend calls the Authify eKYC GST-by-PAN search with the stored PAN and explicit consent. Authify returns every GST registration linked to that PAN, including GSTIN, registration name, registration type, application and authentication status, and contact details. The app de-duplicates the GSTINs and shows them as a simple selectable list. A success is accepted only when Authify confirms it, and a "no records" response is handled gracefully as "no GSTIN found" rather than an error.

GST requests follow the same security model as PAN verification. Between the Flutter app and the platform, a Spring Cloud Gateway filter decrypts RSA-wrapped request payloads and AES-encrypts every response. Between the backend and Authify, each request is encrypted with a fresh AES key that is itself RSA-encrypted with the provider's public key, and the encrypted response is decrypted only inside the user service. The full verified GST response is stored against the merchant in a MySQL JSON column along with verification status and last-verified and last-updated timestamps, giving operations and compliance a complete audit trail.

GST status plugs directly into the document engine. The platform combines the PAN entity code with the merchant's GST holder answer to pick one of four document flows: individual without GST, individual with GST, partnership firm, or company. Document requirements for each flow live in a database table, and the business proof document name is further tailored by the merchant's category code. On the client, BLoC state management drives the bottom sheets, so a merchant who already has a GSTIN on file skips the question entirely and goes straight to the right document list.

Not every GSTIN is discoverable by PAN, so the app offers an "Add manually" path. Manual input is uppercased as the merchant types and checked live against the full GSTIN structure: 2-digit state code, embedded 10-character PAN, entity number, the fixed Z character and a check character. For merchants who add or change a GSTIN from their profile after onboarding, the lead service validates the number against a second provider, Neokred's GST validation API, and rejects it with a clear "Invalid GSTN" error if it does not verify. Adding a verified GSTIN also raises the merchant's profile completion score.

Once verified, GST data travels downstream automatically. During payment partner onboarding, the platform sends the GSTIN and a GST verification flag inside the checksum-protected, encrypted straight-through-processing block, alongside PAN and bank verification flags, before a live UPI QR is issued. For payouts, a scheduler runs at 2:00 AM IST on the last day of every month. GST-registered merchants get a commission due generated with GST added, while non-registered merchants get an invoice directly. The first two digits of the GSTIN decide the tax split: intra-state merchants get CGST 9% plus SGST 9%, and inter-state merchants get IGST 18%, with 10% TDS applied on gross. All rates are environment-configurable.