E-invoicing and ZATCA
Onboarding OTP
The onboarding OTP is a one-time password that a taxpayer gets from the Fatoora portal to start Phase 2 onboarding. You enter it in your invoicing system, which then uses it to request the certificates that connect the system to ZATCA.
What it means
An OTP is a code that works once. In Phase 2 it links the request to connect with your business rather than with any random piece of software. You get it from your own account on the Fatoora portal, which is why a vendor cannot finish onboarding without you. Treat it as a secret, because whoever holds the code can start onboarding in your business's name.
The OTP is the first step of a clear sequence: the OTP, a certificate signing request, the compliance CSID, compliance checks with sample invoices, and finally the production CSID. Because it is one-time, treat it like a key to a single door and request it when you are ready to use it. After each step, make sure it is complete before you start the next one, rather than jumping between stages.
Imagine the finance manager of a contracting company preparing for the wave date. She signs in to the portal, requests the OTP, and enters it in the invoicing system with the provider's guide open beside her. The compliance checks with sample invoices begin right after that. She also notes in the onboarding file the date the OTP was requested and the name of the person who entered it, so if the company later needs to review what happened, it knows whom to ask and when it took place.
In practice
- Request the OTP only when you are ready to enter it in your invoicing system.
- Never share the OTP in chat or email; enter it only in your own system.
- Note who requested the OTP and when, as part of your onboarding records.
- After the OTP step, move on to compliance checks with sample invoices before production.
Questions about Onboarding OTP
Where do I get the onboarding OTP?
From the Fatoora portal, signed in with your own business account. The taxpayer requests it, not the software vendor. You then enter the code in your invoicing system, which carries on with ZATCA. If you are unsure who holds portal access in your company, settle that first.
What happens after I enter the OTP?
You generate a certificate signing request (CSR) and receive a compliance CSID. You then pass compliance checks with sample invoices and receive a production CSID, and live invoices start only after that. ZATCA also provides a simulation environment for practising these steps before production.
Issue correct invoices without the guesswork
Try Fatooraz free for 90 days in ZATCA’s simulation environment. No credit card needed.