The QR code on a Saudi invoice is not a link to a website — it is a structured data packet inside the code itself. The ZATCA app scans it, reads the invoice data directly, and matches it against the printout in front of the customer. That is why verification works even with no connection to the seller's server.
The encoding: TLV, then Base64
ZATCA's specifications define the representation as TLV: each field has a numeric tag, a length, then the value; the fields are laid out in sequence, and the whole packet is Base64-encoded into the QR. This is what makes the code strictly machine-readable — no ambiguous separators, no room for interpretation.
The base fields (since Phase 1)
On a simplified tax invoice, the QR has carried five fields since Phase 1:
- The seller's name
- The seller's VAT registration number
- The invoice timestamp (date and time)
- The invoice total including VAT
- The VAT amount
Matching these fields against the printout is the heart of the check the ZATCA app performs — any mismatch is an immediate red flag.
What Phase 2 added
With the Integration Phase, the specifications added cryptographic fields to the simplified invoice's QR — most notably the invoice (XML) hash, the digital signature, and the invoicing unit's public key. With these, the code no longer proves only the invoice's content but its origin too: that the issuer is a unit registered with the Authority carrying its cryptographic certificate, and that the invoice has not been touched since issue.
What this means in practice
- The QR is generated from the invoice's own data at the moment of issue — never pasted on afterwards, never reused.
- Any post-issue edit breaks the match: a different hash, a signature that no longer verifies — and the check fails.
- A simplified invoice without a QR is a violation and has been since Phase 1; the code is part of correct issuance, not a decoration on it.
In alFatora the QR is built automatically from the stamped invoice document itself, so no path exists that issues a simplified invoice without a valid code.
Was this useful? Review alFatora on Google.
