ZATCA does not certify software in the abstract. It certifies a solution unit — one installation, invoicing for one taxpayer — and issues that unit a cryptographic stamp certificate. Everything the unit signs afterwards is traceable to it.
Before you start
Four details are validated by ZATCA during onboarding and on every document afterwards. Having them right before you begin turns a fifteen-minute job into a five-minute one.
- Your VAT registration number — fifteen digits, beginning and ending with 3.
- Your commercial registration (CR) number.
- Your legal name in Arabic, and the business activity you invoice under.
- Your full national address: street, a four-digit building number, district, city and a five-digit postal code.
The four steps
-
Register the solution unit
A private key and a certificate signing request are generated inside your account. The key never leaves the system and is never displayed — ZATCA's list of prohibited functions names exporting the stamping key explicitly, and no legitimate product will offer to show it to you.
-
Generate a one-time password
In ZATCA's Fatoora portal: E-Invoicing, then Onboard new solution unit / device, then Generate OTP. Paste it into the connection screen.
The code is valid for one hour. If it expires, generate another and press Retry — there is no need to start again.
-
Pass the compliance checks
ZATCA issues a compliance certificate, and the system then submits six sample documents — a tax invoice, a simplified invoice, credit and debit notes among them — which the authority validates against its rules. This is where a missing company detail surfaces, on a sample rather than on a real customer's invoice.
-
Receive the production certificate
Once every sample is accepted, the production certificate is issued and the connection reads Active. It is valid for five years; a document signed with an expired certificate is rejected, so the expiry date is worth a diary entry.
The three environments
| Environment | What it is for | Are the invoices real? |
|---|---|---|
| Developer sandbox | Technical trials of the document format | No |
| Simulation | A faithful copy of production, for a full rehearsal | No |
| Production | Your actual filings | Yes |
Onboarding is per solution unit, not per company. A business invoicing from two systems, or from two branches with their own sequences, onboards each one — and each gets its own certificate and its own chain.
Questions people actually ask
Who can generate the OTP?
Whoever can sign in to the Fatoora portal for the taxpayer — usually the owner or the person who handles the VAT account.
What happens when the certificate is about to expire?
It is renewed the same way it was issued, with a fresh one-time password. Renew before it lapses: documents signed with an expired certificate are rejected outright.
Do the sample documents appear in my books?
No. They are built for the checks and never touch your ledger, your numbering or your VAT return.
Where these facts come from
Checked against the following on 12 September 2026. Rules and dates change — if you are reading this long after that date, verify before you act on it.
WisoBooks is a bookkeeping and business-management tool, not an accounting, tax or legal advisor. Nothing on this page is tax advice, and tax rules change. Confirm your own obligations with the relevant authority or a qualified advisor.
