Fatoora portal: onboarding a device, step by step
Generating the OTP, running the CSR, passing the compliance checks and getting the production certificate — plus what to do when each step fails.
Updated 21 August 2026 · By Fatoza Technologies
Onboarding is a one-time procedure per device that ends with a production certificate — the thing that stamps your real invoices. It takes about ten minutes when nothing goes wrong, and the things that go wrong are predictable.
Before you start
Have these in front of you:
- Your VAT registration number — fifteen digits, starts and ends with 3.
- Your commercial registration or the other identifier you registered with.
- The billing software open on the device you are onboarding. Not another machine. The key pair is generated on the device, and that is the point of it.
- The number of devices you intend to onboard. Each till, each branch.
The steps
The five steps are listed at the top of this page in order. What is worth expanding on is the middle: when you enter the OTP, the software generates a private key that never leaves the device and sends only a certificate signing request. If someone offers to onboard your device from their office, that is a private key you no longer control.
When it fails
“OTP expired.” The most common one, and not a bug. Generate a fresh OTP with the software already open and the cursor in the field.
“Compliance check failed” on a sample invoice. The response body names the field. Three cause almost all of them:
- A malformed VAT number — yours or the buyer’s.
- Invoice total not equal to the sum of line totals plus tax. Usually rounding applied twice.
- A standard invoice sample missing the buyer’s VAT number, which is mandatory on that type.
There is no penalty for retrying, so fix and resubmit rather than filing a ticket.
“Certificate not found” after onboarding apparently succeeded. The certificate lives on the device. If the app data was cleared, the machine reimaged, or the database restored from a backup taken before onboarding, the certificate is gone and the device must be onboarded again with a new OTP.
After onboarding
Your first real invoice is the test that matters. Issue one simplified invoice, confirm it reports within the window, then issue one standard invoice and confirm it clears. Doing both on a quiet morning is much better than discovering the difference during a rush.
The Phase 2 explainer covers what reporting and clearance actually mean if that distinction is still fuzzy.
Frequently asked questions
How long is the OTP valid?
Short — minutes, not hours. Generate it with the billing software already open on the device you are onboarding.
Do I need a separate OTP for each branch?
Yes. Each device or solution unit onboards separately and gets its own certificate. A single certificate copied across branches breaks the per-device model the stamp relies on.
The compliance check failed. What now?
The response names the failing field. In practice it is nearly always a malformed VAT number, a total that does not equal the sum of the lines, or a missing buyer VAT number on a standard invoice sample. Fix and resubmit; there is no penalty for retrying.
Related
People also search for
fatoora portal · zatca otp onboarding · csid certificate zatca · fatoora portal login · zatca compliance check failed