Represent a Client authorization: a RepID, then your client approves

Which authorization route should you use?

You first register yourself in Represent a Client and get a RepID, a seven character code the CRA issues to each representative canada.ca. From there, either the client adds you from their own CRA account, or you send an authorization request and the client approves it canada.ca. As of October 2026 the routes compare like this.

The 10 business day limit and the sole proprietor timing come from the CRA's confirmation page canada.ca. The EFILE route needs you to be a registered electronic filer in good standing using certified software, and you keep the signature page for six years instead of sending it in canada.ca. AUT-01 never gives online access, so it's the fallback for a client who only needs you on the phone canada.ca.

RepID, GroupID or business number: which one do you give the client?

Whichever identifier the client authorizes is the one that holds the access. Pick it before you send the first request, because moving clients later means new authorizations.

The format and group limits are on the CRA's Represent a Client help page, which also says a sole proprietor without a BN registers as an individual canada.ca. To register the firm's BN, you must be listed as an owner, partner, director or officer in the CRA's BN database and have your SIN associated with the business. Each employee still needs their own RepID before you can associate them canada.ca.

The payoff of a GroupID is staffing: clients authorize the group, so a new hire joins it and no new client authorization is needed canada.ca. Never give a client the group's name. Only the GroupID number works in the authorization process canada.ca.

What do Level 1 and Level 2 let you do?

For an individual client, Level 1 is view only and Level 2 adds certain changes. Choose Level 2 if you'll file adjustments, objections or relief requests canada.ca.

That last row matters: neither level can change a client's address or direct deposit, or authorize another representative. Those belong to a legal representative appointed by a legal document canada.ca. A Level 1 representative can't register a formal dispute or file a relief request, so a Level 1 authorization found the week an objection is due is a real problem.

Business accounts add Level 3, delegated authority. A Level 3 representative can authorize more representatives, including other delegated authority, on the business's behalf canada.ca.

Worked example: the six month rule and the 10 day clock

The notice of assessment route works only with a notice issued at least six months ago canada.ca. Say your new client filed their 2025 return in the spring and got the notice of assessment dated May 4, 2026. That notice is usable from November 4, 2026. Before then, you'd enter the figures from their 2024 notice of assessment instead, if they still have it.

Now the confirmation route. You submit a request in Represent a Client on Monday, November 16, 2026 with "client will confirm in My Account". Counting 10 business days after the day you submit (no statutory holidays fall in that stretch) puts the client's last day at Monday, November 30, 2026. Miss it and the request is cancelled, and you start a new one canada.ca.

The request itself runs in this order: Representative account, Authorization request, client type, Add authorization, the client's identifying details, the confirmation method, then the level, an expiry date and (for a business) the program accounts canada.ca. For the notice of assessment route, the client signs the certification page and you upload it with the Submit button. Don't mail or fax it canada.ca.

Edge cases that stall a request

Since July 15, 2025, the Authorize a Representative service in EFILE software no longer works for individual clients. Business clients can still be authorized through EFILE. The same change stopped anyone from submitting a request on behalf of another representative, although GroupID and BN administrators can still manage requests for their own group or firm canada.ca.

Two cases can't use the online confirmation at all: a business where every owner or director is a nonresident of Canada and no one holds delegated authority, and a request certified by a legal representative such as an executor or trustee. For those, you upload the signed certification page that Represent a Client generates canada.ca. For a deceased client, the legal documents must be processed before a certified request can go in canada.ca.

A trust is confirmed by its primary trustee in My Trust Account, not My Account canada.ca. And protect your RepID: a cancelled RepID can never be reactivated by you or the CRA, so every client would have to authorize your new one. For seasonal staff, disassociate them instead of deleting them, which keeps their RepID and client authorizations for next season canada.ca.

How does an authorization end?

Access lasts until the client or you cancel it, or until the expiry date set in the request canada.ca. Removing a representative online cancels access immediately, and you can cancel your own authorization in Represent a Client. Offline, the client sends Form AUT-01X to the tax centre on the form within six months of signing, or calls 1-800-959-8281 for a personal account and 1-800-959-5525 for a business account canada.ca.