Skip to content

Devices, certificates and branches

ZATCA does not only register your company to issue e-invoices. It registers each copy of invoicing software that issues them. In Clix, that registration is a ZATCA connection.

That one fact explains most of the setup: why you cannot invoice before connecting to ZATCA, why an expired certificate stops invoicing, and why a second shop may need its own connection.

What a ZATCA connection is

What it is. A ZATCA connection is one registered unit of invoicing software. ZATCA calls it an E-Invoice Solution Unit, or EGS unit; some Clix screens call it a device. It is the part of the software that links your invoices in one unbroken chain and stamps them (Implementation Resolution, Clause Third (2)(E)(2), p. 5). You register it once, on ZATCA's Fatoora portal, with a one-time code. ZATCA then issues the connection a certificate (CSID): its digital identity card. See Certificates.

A small business usually needs one connection. Add another for each place or system that issues invoices on its own, such as a second shop.

Why ZATCA requires it. ZATCA's rules oblige you to register the units that generate your e-invoices, and to keep their cryptographic identifiers safe (Implementation Resolution, Clause Seventh (7)–(8), p. 7; E-Invoicing Detailed Guidelines §7.4, p. 39). In the integration phase (Phase 2), both standard and simplified invoices must come from a unit that has been onboarded (Detailed Guidelines §4.1.2(a), p. 15; §4.2.2(a), p. 18). If one VAT number has several devices, ZATCA's answer is: "Yes, every device issuing invoices with the same VAT number should be registered" (Detailed Guidelines, FAQ, p. 59).

What to do in Clix. Open ZATCA Connections in the left navigation. The Connections tab lists your connections and their status. An Admin adds one with Connect to ZATCA; the steps are in Connect a device to ZATCA.

Where next.

How they fit together

An organisation has a business-level connection that uses the Company Profile address, and branches whose connections use the branch address; each connection has its own certificate issued by ZATCA An organisation has a business-level connection that uses the Company Profile address, and branches whose connections use the branch address; each connection has its own certificate issued by ZATCA

  • An organisation is your business and its VAT registration. Its address is on the Company Profile.
  • A branch is an optional location with its own address and business ID. Branches are a Pro and Business feature.
  • A device, called a ZATCA connection in Clix, is a registration with ZATCA. It is either linked to one branch or is a business-level connection with no branch. It issues Businesses (B2B), Consumers (B2C) or Both invoice types.
  • A certificate is what ZATCA issues to that connection. The connection signs with it.

The address on an invoice comes from the connection: the branch address for a branch connection, the Company Profile address for a business-level one.

Practical consequences:

  • You cannot issue an invoice before a connection exists. There is nothing to sign with.
  • A connection is set to an invoice type: Businesses (standard, B2B), Consumers (simplified, B2C) or Both. Choose Both when one till issues both kinds.
  • Certificates expire. Renewal is routine maintenance, not an exception.

Branches and locations

What it is. When you add a connection, the step Where is this connection? asks where it issues invoices from. You have two choices:

Choice The connection becomes The invoice carries
Enter location, then a city a Business-level connection the address on your Company Profile
Select a branch, then the Branch a branch connection the branch's address and business ID

A branch is a location with its own address, such as a second shop, a warehouse or a regional office. Most small businesses invoice from one place and need no branch at all.

Why ZATCA requires it. Every tax invoice must carry the seller's name, address and VAT number (Implementation Resolution, Annex 2, items 4.1–4.3, p. 19). The seller address must include the street, building number, postal code, city, district and country (XML Implementation Standard, BR-KSA-09, p. 49). The invoice is issued in the name of the head office as it appears on your VAT registration certificate; the branch name may be added (Tax Invoicing guideline, question 15, p. 57). If you hold several commercial registrations, the invoice carries the one for the branch that issues it (Implementation Resolution, Annex 2, item 4.4, p. 19–20).

What to do in Clix.

  • One place of business: choose Enter location and type the city. Check that your Company Profile address is complete.
  • Several places, each with its own address: on Pro or Business, add a branch first. Then choose Select a branch when you connect. The branch City must match the connection's city.
  • Do not add a branch for an internal team or a cost centre: the branch address goes on the invoice.

You choose the branch when you create the connection, not afterwards.

Where next.

Certificates

What it is. A certificate is a connection's digital identity card. ZATCA calls it a Cryptographic Stamp Identifier, or CSID. It ties the connection to your business, so each invoice can be traced to the unit that issued it. Clix signs every invoice from that connection with it.

During registration Clix creates a signing request and sends it to ZATCA with your six-digit code from the Fatoora portal. ZATCA first issues a compliance certificate. Clix passes ZATCA's compliance check with sample invoices, and ZATCA then issues the production certificate. Clix stores the certificate and its private key. You never handle either: the Fatoora code is the only part that passes through your hands.

A certificate is valid until a fixed date. After that it must be renewed.

Why ZATCA requires it. ZATCA defines the CSID as "a unique identifier that links the E-Invoice Solution Unit" to a trusted party that confirms your identity and "uniquely identif[ies] their unit" (E-Invoicing Detailed Guidelines §2.10, p. 10). The Fatoora portal is where a unit is onboarded "through generating cryptographic stamp identifier or renewing the existing one or revoking it" (§2.8, p. 10). Each unit that issues simplified invoices must have its own identifier, issued and managed through ZATCA's portal, and a new stamping key is generated when the identifier is renewed (Implementation Resolution, Annex 1, Cryptographic Stamp, p. 12). You must keep the identifier and its key safe from copying and misuse (Clause Seventh (8), p. 7).

What to do in Clix.

  • To see every certificate's state, open ZATCA Connections, then the Compliance tab. The Certificate Overview counts them as Active, Expiring Soon, Expired or Unknown, with each Valid Until date.
  • To see one connection's dates, click the ⋯ button on its row, then More Details. The panel shows Certificate valid from and Certificate valid until.
  • When a certificate is within 30 days of expiry, or has expired, Clix emails your Admins and the row's menu shows Renew certificate.

Where next.

What breaks, and what does not

Event Effect
Certificate expires That connection cannot sign. Existing invoices stay cleared or reported.
Branch edited or archived Not possible while a connection is linked to it.
Company Profile address corrected Applies to invoices issued afterwards only.
Organisation VAT number corrected Possible only until ZATCA has seen it. Earlier invoices keep what they carried.

The pattern is consistent: issued documents never change retroactively. A cleared invoice is a tax record, and corrections are made with credit and debit notes, never by editing history.

ZATCA sources

ZATCA publishes each text in Arabic and English; where they differ, the Arabic prevails.