Skip to content

ZATCA

ZATCA e-invoicing

Phase 1 QR codes are part of the core licence. Phase 2 Fatoora integration is an add-on module.

The Saudi Zakat, Tax and Customs Authority requires electronic invoices in two stages. RKCoders POS handles both, and it does the awkward parts, the cryptography and the onboarding, for you.

Phase 1 — Generation

Included in Core POS

As soon as a sale is paid, the app builds a TLV-encoded QR code and prints it on the receipt. Nothing to configure beyond entering your seller name and VAT number in Settings.

  • Tag 1 — Seller name
  • Tag 2 — VAT registration number
  • Tag 3 — Invoice timestamp
  • Tag 4 — Invoice total including VAT
  • Tag 5 — VAT total
The invoice type is chosen automatically. If the customer on the ticket has a VAT number the sale becomes a standard tax invoice; otherwise it is a simplified tax invoice. Voided bills are never sent to ZATCA.
Phase 1 — Generation

Phase 2 — Integration

Add-on module

Phase 2 means your device has to be registered with ZATCA, and every invoice has to be cryptographically signed and either cleared or reported through the Fatoora platform. The app runs that whole pipeline.

  • Generates the EGS keypair and certificate signing request on the till
  • Requests a compliance CSID using the OTP from the ZATCA portal
  • Submits the required compliance sample invoices
  • Requests and stores the production CSID
  • Builds a UBL 2.1 XML document for each invoice
  • Signs it with ECDSA and embeds the signature and certificate
  • Extends the QR code with tags 6 to 9: XML hash, signature, public key and certificate stamp
  • Clears standard tax invoices synchronously before they can be printed
  • Signs and queues simplified invoices for asynchronous reporting

Six-step onboarding wizard

Phase 2 registration is done once per till, from Settings. The wizard walks through it in order and remembers where you got to.

  1. Seller details

    Company name, VAT number, commercial registration and address, exactly as they appear on your ZATCA record.

  2. Environment and branch

    Choose sandbox, simulation or production, then enter the branch and industry details for this device.

  3. Generate the CSR

    The app creates the private key and certificate signing request locally. The private key never leaves the machine.

  4. Compliance CSID

    Paste the one-time password from the ZATCA portal and the app exchanges the CSR for a compliance certificate.

  5. Compliance samples

    The required sample invoices are generated, signed and submitted automatically to prove the device works.

  6. Production CSID

    The final production certificate is issued and stored. The till is now live.

Six-step onboarding wizard

Three environments

Practise safely before you go live. Sandbox is for first experiments, simulation mirrors production behaviour for end-to-end testing, and production is the real thing.

Every invoice has a status

You can see exactly where each document stands from the Documents screen, and filter by it.

  • None

    Phase 2 is not active for this document.

  • Pending

    Signed and waiting to be submitted or accepted.

  • Cleared

    A standard tax invoice that ZATCA has cleared. Safe to print.

  • Reported

    A simplified invoice that has been reported successfully.

  • Warning

    Accepted by ZATCA, but with validation warnings worth reading.

  • Failed

    Rejected or unreachable. It sits in the retry queue and can be resubmitted by hand.

What happens when Fatoora is unreachable

Simplified invoices are reported after the fact, so a dropped connection never blocks the queue at your counter. Anything that fails goes into an outbox and is retried, and you can force a retry from the document at any time. Standard tax invoices are the exception: because they must be cleared before issue, printing one is held back until clearance succeeds.

You keep the evidence

Both the unsigned and signed XML are stored against every document, and you can download the signed XML whenever an auditor asks for it.

Compliance responsibility: RKCoders POS implements the ZATCA technical specification, but your registration details, tax rates and filing remain your responsibility. Always validate your setup in the simulation environment before going live.
Read the guide Pricing