Onboarding to the Fatoora platform is the step that actually moves your business into Phase 2: registering your e-invoicing units with the platform, getting each unit its cryptographic certificate, and passing compliance checks before the first production invoice. The path as ZATCA publishes it is clearly staged — what derails businesses is rarely its complexity, but leaving it until days before the compliance date.
Before you start
You need two things: your taxpayer portal credentials with the Authority, and a compliant e-invoicing system covering the Phase 2 requirements — XML generation in the approved format, cryptographic stamping, the sequential invoice counter, and the previous-invoice-hash chain.
The onboarding steps, as ZATCA publishes them
- Log in to the Fatoora platform with your taxpayer portal credentials.
- Generate a one-time password (OTP) on the platform for each e-invoicing unit you want to register — the OTP is short-lived, so it goes into your invoicing system as soon as it is created.
- Submit the certificate request: your invoicing system generates a certificate signing request (CSR) and submits it with the OTP; the platform issues the unit a temporary compliance certificate.
- Pass the compliance checks: using that certificate, the unit submits samples of its documents — an invoice, a credit note, a debit note, of the types it will actually issue — and the platform validates them.
- Receive the production certificate: once the checks pass, the compliance certificate is replaced with a production one, and the unit is authorised to submit real invoices for clearance or reporting.
Where to practise
Alongside its developer environment, ZATCA publishes a simulation environment of the Fatoora platform, for exercising the full path — registration through clearance — with no effect on production. Practise there first: a data error found in simulation costs nothing; found in production, it is a rejected invoice.
Worth knowing
- Certificates belong to units, not to the business: every invoicing unit (a branch, a POS, a system) is registered and carries its own certificate.
- Certificates expire and renew: managing their lifecycle — issue, renewal, revocation when a unit is retired — is part of the ongoing obligation, not a one-time step.
- The hash chain must not break: from the first stamped document onward, issue order becomes part of compliance itself.
This whole path — the requests, the certificates, the checks, the renewals — is what alFatora carries for you: register your business, and we take the integration from sandbox to production on your behalf.
Was this useful? Review alFatora on Google.
