CSID onboarding, step by step

You will meet two CSIDs. The compliance CSID is issued first and exists for testing: your solution submits sample invoices against it so ZATCA can verify the documents are built correctly. The production CSID is issued after those checks pass, and it is the stamp on your live documents. Treating the compliance stamp as the finish line is the most common onboarding misunderstanding — with it, nothing you issue is cleared or reported for real.

Notice what the sequence assumes: the portal identity is the firm's, the CSR is generated by the solution, and the two meet in the middle. Any offer to onboard you entirely from someone else's account is a warning sign.

• Start on the Fatoora portal with your firm's own access — onboarding begins from the taxpayer's account, and a one-time password (OTP) is issued there for your solution to use.
• Your e-invoicing solution (the EGS unit) generates a Certificate Signing Request (CSR) carrying your firm's identity — VAT number and organisation details as registered.
• The CSR and the portal OTP are exchanged for the compliance CSID.
• Your solution runs the compliance checks: test standard and simplified documents, cleared and reported in the test environment.
• On passing, the production CSID is issued — from that moment your solution clears standard invoices and reports simplified ones live.

• Your VAT registration number and the organisation name exactly as registered with ZATCA.
• Access to the Fatoora portal by the firm's authorised person — the OTP step cannot be delegated to a stranger.
• Your solution provider's onboarding instructions for generating the CSR from your invoicing system.
• A decision about who in the firm keeps the production credentials — they are the keys to your invoicing identity.

Three stalls account for nearly all of it. First, portal access: the person holding the firm's ZATCA login is travelling, or the registered mobile changed, and the OTP cannot be retrieved. Second, identity mismatch: the name or VAT number in the CSR differs from the registration, and the exchange fails. Third, stopping early: compliance CSID received, team celebrates, production CSID never requested.

All three are cheaper to fix before your wave's deadline month than during it — January 2027 will stress every provider's onboarding support, ours included when the time comes.

The CSID is the second of six criteria when you choose integration software — the full checklist, including the directory-listing honesty test, is in the software-choosing guide.