India GSTIN Validation API: GST Number Verification for Developers

India's GST system uses a GSTIN (Goods and Services Tax Identification Number) — a 15-character alphanumeric tax ID assigned to every GST-registered business. Unlike EU VAT numbers, a GSTIN encodes state-level information and the registrant's PAN (Permanent Account Number), making format validation more complex. The TaxID API validates GSTINs against the GSTN (Goods and Services Tax Network) and returns the registered business name and state.

GSTIN Format

A GSTIN is always 15 characters in the format: 2-digit state code + 10-character PAN + 1-digit entity number + 1 letter Z (always Z) + 1 check digit.

Position	Characters	Description
1-2	2 digits	State code (01=Jammu & Kashmir, 07=Delhi, 27=Maharashtra, etc.)
3-12	10 chars	PAN of the taxpayer (letters and digits)
13	1 digit	Entity number (1 for first registration, 2 for second, etc.)
14	1 char	Always Z
15	1 char	Check digit (calculated)]

typescriptlib/validate-gstin.ts

// GSTIN regex pattern: 2 digits + 5 letters + 4 digits + 1 letter + 1Z + 1 alphanumeric
const GSTIN_PATTERN = /^\d{2}[A-Z]{5}\d{4}[A-Z]{1}[1-9A-Z]{1}Z[\dA-Z]{1}$/;

export function isValidGstinFormat(gstin: string): boolean {
  return GSTIN_PATTERN.test(gstin.toUpperCase());
}

export async function validateGstin(gstin: string) {
  const normalised = gstin.replace(/\s/g, '').toUpperCase();

  if (!isValidGstinFormat(normalised)) {
    return { valid: false, status: 'format_invalid', company_name: null };
  }

  const res = await fetch(
    `https://taxid.dev/api/v1/validate/IN/${normalised}`,
    { headers: { Authorization: `Bearer ${process.env.TAXID_API_KEY}` } }
  );

  return res.json();
}

pythonvalidate_gstin.py

import os, re, requests

GSTIN_PATTERN = re.compile(r'^\d{2}[A-Z]{5}\d{4}[A-Z][1-9A-Z]Z[\dA-Z]$')

def validate_gstin(gstin: str) -> dict:
    normalised = gstin.replace(' ', '').upper()
    if not GSTIN_PATTERN.match(normalised):
        return {'valid': False, 'status': 'format_invalid', 'company_name': None}

    resp = requests.get(
        f'https://taxid.dev/api/v1/validate/IN/{normalised}',
        headers={'Authorization': f'Bearer {os.environ["TAXID_API_KEY"]}'},
        timeout=5,
    )
    resp.raise_for_status()
    return resp.json()