Guide

How to get a ZATCA CSID

Connecting your invoicing system to ZATCA for Phase 2, in four steps.

Start free Book a demo

A CSID (cryptographic stamp identifier) is the certificate ZATCA issues to each invoicing system (an EGS unit) so it can sign invoices for Phase 2. You get one by generating a key and a certificate request with your VAT details, entering a one-time password (OTP) from the FATOORA portal to receive a compliance CSID, passing ZATCA's compliance checks with sample invoices, and then requesting the production CSID that signs real invoices.

The four steps

  1. 1

    1. Key and certificate request

    The system makes a private key and a certificate signing request (CSR) carrying your VAT number, organisation name, branch and the invoice types you issue (standard, simplified, or both). The private key never leaves your system.

  2. 2

    2. OTP and compliance CSID

    In the FATOORA portal, the taxpayer generates a one-time password for onboarding a solution. Entered in the system with the request, it returns a compliance CSID — a test certificate for the next step. The OTP expires quickly, so generate it when you are ready to use it.

  3. 3

    3. Compliance checks

    The system signs a sample of each document type it will issue — invoice, credit note and debit note, standard and simplified — and sends them to ZATCA's compliance check. Each must pass; a failure comes back with ZATCA's rule code.

  4. 4

    4. Production CSID

    Once every check has passed, the system requests the production CSID. From then on each invoice is signed with it and cleared or reported to ZATCA.

Questions

Do I need a CSID for every branch or system?

Each invoicing unit that signs invoices is onboarded with its own certificate. A company with several tills or systems onboards each one.

What happens when the CSID expires?

It is renewed with a fresh OTP and a new key, authenticated with the current certificate; the compliance checks are not repeated. Dopave warns before the expiry date.

How does Dopave do this?

In Settings → E-invoicing, the four steps are on one screen: you enter your VAT details and the OTP, and Dopave makes the key, runs the six compliance checks and fetches the production CSID. The key and certificates are stored encrypted.

Related

Try it on your own company's data — free, no credit card.

Start free