Capture HMRC fraud-prevention browser context
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Allow the module to collect the browser and session context required for HMRC fraud-prevention headers.
What you’ll accomplish
Allow the module to collect the browser and session context required for HMRC fraud-prevention headers. The MTD module stores tax profiles, HMRC authority, obligations, frozen filing snapshots, approvals and audit evidence, while Accounting remains the primary financial record system.
Follow these steps
- Go to the Tax Centre from the same browser/session that will perform the HMRC action.
- Allow the module JavaScript to capture the required browser context through the protected fraud-context route.
- Make sure the deployment can determine trusted server-side connection information and the configured vendor public IP for Production.
- Do not manually copy or invent fraud-prevention header values.
- Run HMRC fraud-prevention validation during Sandbox/Production approval and resolve every header error before live filing.
Checks before you continue
Technical basis for this guidance
This guide was checked against controllers/Mtd_hmrc_oauth.php; libraries/Mtd_hmrc_oauth_service.php; libraries/Mtd_hmrc_crypto.php; libraries/Mtd_hmrc_fraud_header_service.php. The user instructions describe only behaviour exposed or enforced by the supplied module. Internal secrets, encrypted token values and database identifiers are intentionally not shown to ordinary users.
Compliance and operational boundaries
- Pixie CRM Accounting & Bookkeeping remains the authoritative ledger; the MTD module is a tax preparation/submission layer.
- Government Gateway usernames and passwords must never be entered into or stored by Pixie CRM.
- A tax filing must not proceed when transaction-level digital lineage cannot be proven.