Onboarding a terminal with ZATCA: CSR, OTP, CSID, in order
Every till that signs an invoice needs its own certificate from the authority. Here is the exact sequence, what each step produces, what goes wrong, and what to do when you add a terminal at 7pm.
4 min read
A point of sale cannot cryptographically stamp an invoice until the Zakat, Tax and Customs Authority has issued that specific device a certificate. This process is called onboarding, and it happensper device — not per company, not per branch.
Here is the sequence, and what can go wrong at each step.
Step 1: the device generates a key pair and a CSR
Your POS creates a private key, which never leaves the device, and a certificate signing request describing the device and your organisation.
What goes wrong: the CSR carries fields that must match your ZATCA registration exactly — your VAT number, your organisation name, the device serial or identifier, and the invoice types this device will issue. A typo here fails the exchange at step 3 with an error message that does not say "typo".
What to check: your VAT registration number is 15 digits and matches the portal. Your organisation name matches your commercial registration.
Step 2: get a one-time password from Fatoora
Log in to the Fatoora portal, choose to onboard a new device, and generate an OTP. It is short-lived — plan to use it within the hour.
What goes wrong: the OTP expires while someone looks for the terminal's serial number. Have the device details ready before you generate it.
Step 3: exchange CSR + OTP for a compliance CSID
The system sends the CSR and OTP to ZATCA and receives acompliance CSID — a temporary certificate that lets the device take the compliance tests.
What goes wrong: mismatched CSR fields (step 1), expired OTP (step 2), or an outbound firewall blocking the authority's endpoints. The third is common in networks locked down by an IT contractor; make sure the required hosts are allowed before you start.
Step 4: pass the compliance checks
The device must submit sample documents of every type it will issue — a simplified invoice, a credit note, a debit note, and the standard equivalents if applicable — and each must validate.
What goes wrong: the device is configured for invoice types it is not going to issue, and then fails the checks for those types. Configure the device for what it actually does.
Step 5: receive the production CSID
On passing, ZATCA issues aproduction CSID. This is the certificate the device signs live invoices with. From this moment the terminal is compliant and can issue.
Renewal
Certificates do not last forever. A good system tracks the expiry and renews before it lapses; a system that does not will one day stop signing in the middle of a shift.
Ask your vendor: "What happens 30 days before a CSID expires? What do I see, and who acts?"
The practical scenario: a terminal on a Thursday evening
You add a till. What does it take to make it issue invoices?
- Good answer: open the new device, enter the OTP from the portal, wait a minute, start selling. You do it yourself, in five minutes, at 7pm.
- Bad answer: raise a support ticket, wait for business hours.
This is a real differentiator and it is easy to test in a demo: ask them to onboard a fresh device in front of you.
Wameed runs the whole exchange from the terminal itself. You provide the OTP; the CSR, the compliance CSID, the checks, the production CSID and the renewal schedule are handled by the system, and each device's certificate status is visible in the back office.
Multi-branch notes
- Every terminal needs its own CSID. Ten tills across three branches means ten onboardings.
- Keep a register: device, branch, onboarding date, expiry date.
- When you retire a device, decommission it properly rather than leaving an active certificate on a machine in a drawer.
- When you move a device between branches, check whether your configuration ties it to a branch identifier — if so it needs re-onboarding.
Before you start, gather
- Your VAT registration number
- Your commercial registration number
- Your Fatoora portal credentials
- The device identifier or serial for each terminal
- Confirmation that outbound HTTPS to the authority's hosts is not blocked
With those five in hand, onboarding a device is a few minutes' work. Without them it is an afternoon.
More on how this works in Wameed on theZATCA page, and the wider requirements in thecomplete Phase 2 guide.
Not tax or legal advice; confirm your own obligations with ZATCA.
- #CSID
- #onboarding
- #تسجيل الجهاز
- #ZATCA
Ask about your own shop
Thirty minutes on your products, your tax setup and your hardware — not a slide deck.
Keep reading
5 min read
ZATCA Phase 2: the complete guide for Saudi merchants
What Phase 2 actually requires of your till, in plain language: the XML, the cryptographic stamp, the hash chain, clearance versus reporting, and the eight things to check before your wave arrives.
4 min read
Simplified vs standard tax invoice: which one are you issuing?
Getting this wrong is the most common Phase 2 mistake. The two invoice types follow different flows, carry different fields and have different deadlines — and your POS must choose correctly at the counter.
4 min read
The ZATCA QR code: what is inside it and how to check yours
The square on your receipt is a signed data structure, not a link. Here is exactly what it encodes, why Phase 2 added three fields to it, and how to verify your own printer is producing a valid one.