ZATCA Phase 2 onboarding step by step: from the one-time code and the CSR to your production certificate

ZATCA Phase 2 onboarding has five steps for each invoicing device: get a one-time code (OTP) from the Fatoora portal, create a CSR (certificate signing request), receive a compliance certificate, pass the compliance checks, then receive the production certificate. The code is valid for one hour, and a failure sends you back to the start.

What changed. 24 July 2026: ZATCA set Wave 25 for taxpayers with VAT-able revenue above SAR 187,500 in any of 2022 to 2025, with 1 February 2027 as the latest integration date. Nothing in the onboarding steps below changed in that notice; we read them in ZATCA's own guideline on 6 November 2026.

The five steps at a glance

"Invoicing device" here means what ZATCA calls an e-invoicing generation solution unit (EGS unit): a branch system, a point-of-sale, a server or an app that issues invoices. A company with five branches that each issue invoices usually has five units. Each unit has its own certificate.

Step 1: get the one-time code

Sign in to the Fatoora portal with the same login you use for VAT (your tax number or the registered e-mail, and the password). This is not the Developer Portal login. The portal opens only for a taxpayer whose VAT status is Active or Reactive. If your status becomes Deregistered or Suspended you can only view your list of units for 90 days.

Click "Onboard New Solution Unit/Device", type how many codes you need (one per device), and copy or download the codes. Each code lasts 1 hour. There are two ways to get one:

• Manual: you copy the code from the portal and paste it into your invoicing system. You can generate codes for several devices at once.
• Automatic: you open the portal from the device itself and the code is read for you. This works for one device at a time.

Do this step only when the person who will paste the code is ready. A code that expires is not an error to fix; you generate another.

Step 2: the CSR

Once the code is entered, your system builds the CSR and a private and public key pair, and sends the request to ZATCA. The CSR carries facts about your company and the device:

The invoice type matters twice: it tells ZATCA what the device will issue, and it decides which compliance checks the device must pass. Check it against your sales: a point-of-sale that only sells to consumers is 0100, a head-office system billing companies is 1000.

ZATCA's guideline lists the errors a CSR can return: an invalid code (not exactly six digits, or not a number), a code that does not match one generated for your tax number, an expired code, an invalid VAT number, an invalid request type and missing fields. Most come from a typo, a late paste or a wrong tax number on the device.

Steps 3 and 4: compliance certificate and compliance checks

If the CSR is accepted, ZATCA returns a compliance CSID, a self-signed certificate that lets the process continue. Your device now proves it can produce valid documents. It sends three sample documents for each type it will issue:

• Device set to 1000: a standard tax invoice, a standard debit note and a standard credit note.
• Device set to 0100: a simplified tax invoice, a simplified debit note and a simplified credit note.
• Device set to 1100: the guideline lists the two sets above only. Our onboarding job sends both, six documents.

ZATCA checks each against all its validations. The device runs this by itself, so you will rarely see it. If one or more tests fail or are not completed, the device must restart from a new code and a new CSR. Fix the cause before you retry.

Step 5: the production certificate

When every check passes, the device asks for its production CSID and ZATCA issues it. This is the certificate the device uses to send real invoices. ZATCA's guideline says a CSID is generated once during onboarding and then stays valid for multiple years; it does not give a number of years, so read the expiry on your own certificate.

Renewal works like onboarding, with one difference: the old certificate is revoked and a new one is issued. You can also revoke a certificate yourself in the portal, for example when the device is lost, sold, compromised or upgraded in a major way. A revocation cannot be undone, but the device can be onboarded again as a new device.

Simulation first, then production

The Fatoora simulation portal is an optional tool for end-to-end functional testing; it is not for load testing. It is a separate environment: onboarding a device there does not onboard it in the real portal. Plan the work as two runs of the same five steps. The first proves your system and your data in simulation. The second creates the real certificate.

A pre-flight checklist for onboarding day

1. Your VAT status is Active or Reactive and you can sign in to the Fatoora portal. Test the login a week early.
2. You know who will paste the code, and they will be at the keyboard when you generate it.
3. You have a list of devices, with the invoice type for each: 1000, 0100 or 1100.
4. Your 15-digit VAT number is stored exactly as registered, in every branch that issues invoices.
5. Each device has a unique name or asset number.
6. Branch locations are filled in, in the form your solution provider asks for.
7. You have a named person to read ZATCA's error message and a contact at your solution provider.
8. You run the simulation first and keep its result.
9. You write down the date of each certificate, so renewal is a task and not a surprise.

Which wave are you in?

ZATCA tells each wave's taxpayers directly at least six months before their integration date. Wave 25 has until 1 February 2027. Use our wave guide to find yours from your revenue. If you also trade in the UAE, its rules work differently: read the UAE e-invoicing timeline.

How Tarleaks helps

Tarleaks Accounting runs the onboarding as one background job per device: key, request, compliance certificate, checks, production certificate, activation. Each step is saved, so a job that stops resumes from its last saved step, and the one-time code is kept only in the memory of the task that uses it. If the job stops before the code is used, you generate a new code. Our ZATCA connection is in pilot and not certified.

What to do next

• Confirm your wave, then list your devices and their invoice types.
• Test the Fatoora login and the simulation portal this month, not the week of your date.
• Ask your solution provider how its product runs steps 2 to 5 and who handles a failed check.
• Book a demo to see the unit onboarding screen with sample data.

Questions people ask

How long is the ZATCA onboarding one-time code valid?

One hour from the moment the Fatoora portal generates it. You must enter it on your invoicing system within that hour. If it expires, generate a new one.

What is the difference between the compliance CSID and the production CSID?

The compliance CSID is a first, self-signed certificate that lets your system run ZATCA's compliance checks. The production CSID is the certificate your system receives after it passes them, and it is the one used to send real invoices to ZATCA.

Do I have to onboard every device or branch?

Yes. Onboarding is done for each e-invoicing generation solution unit, and each unit gets its own certificate. You can generate several one-time codes at once in the portal, one for each unit you onboard.

What happens if a compliance check fails?

The unit must restart the onboarding from a new one-time code and a new CSR, and run the checks again. Your solution provider's manual says how to fix the document that failed.

Is the simulation portal the same as the real one?

No. They are two independent environments. A device onboarded in the simulation portal is not onboarded in the Fatoora portal, so you onboard it again for production.

---

General information, not legal or tax advice. Checked against the official ZATCA sources listed on this page on 6 November 2026. The Detailed Technical Guideline is version 2 and its text may be updated: check ZATCA's website before you onboard. Confirm your position with ZATCA or your adviser.