Skip to content

Devices and certificates

A ZATCA connection (a device, in ZATCA's words) is your registration with ZATCA. Every invoice is signed through one, so nothing can be issued until at least one connection is Active. Found under ZATCA Connections.

Who. Everyone can open ZATCA Connections. Only an Admin sees Connect to ZATCA.

What you see

Before any connection exists, the screen reads "Issue compliant e-invoices from anywhere" and offers Connect to ZATCA and How it works.

the ZATCA Connections screen before any connection exists

Once connections exist, the Connections tab lists them.

the Connections tab listing connections with their branch and status

  1. Connection name, with the invoice type underneath: B2B, B2C or Both.
  2. Location: the city you entered, or the branch's city.
  3. Branch: the linked branch, or "Business-level connection" when there is none.
  4. Status: see what each status means.
  5. Created at, and the ⋯ menu, Manage connection.
On the Connections tab What it does
Search Filters the list by what you type, from 2 characters.
Filter Business Type, Date From, Date to, Linked to Branch, Branch is Active. "No connections match your search or filters" when nothing fits.
How it works Opens a short guide: What is a ZATCA connection?, Which invoices will you issue?, Why do you need to connect to ZATCA? and How to connect, with Connect to ZATCA and Skip.

The Compliance tab shows the Certificate Overview: how many certificates are Active, Expiring Soon, Expired or Unknown, and each connection's Valid Until date.

the Compliance tab with the Certificate Overview counts

On the Compliance tab What it does
Search "Search by device name or serial number..."
Chips All, Active, Expiring, Expired, each with its count. The counts cover every connection and do not change with the search.
Warnings "n certificate(s) have expired…" and "n certificate(s) will expire within 30 days…" above the list.

The dot on the sidebar

Once a connection exists, ZATCA Connections in the sidebar carries a mark. Hover over it to read what it means.

Mark Meaning
Green dot "All connections active — you're compliant with ZATCA"
Amber dot Some certificates expire within 30 days
Red badge with a number That many certificates have expired

What a connection is tied to

Tied to Why it matters
A branch, or none A branch connection puts the branch's address on its invoices. A business-level connection uses the Company Profile address.
An invoice type Businesses (standard, B2B), Consumers (simplified, B2C), or Both. If your organisation sells to only one kind of buyer, the choice is fixed to it.
A certificate Issued by ZATCA when the connection is made, valid until a fixed date.

Tasks

Connect to ZATCA

Why. Nothing can be invoiced without a connection.

Who. Admin.

  1. Open ZATCA Connections and click Connect to ZATCA.
  2. Enter a Connection name you will recognise, for example "Main store".
  3. Under Who will you invoice?, choose Businesses, Consumers or Both.
  4. Under Where is this connection?, choose Enter location and type the city, or choose Select a branch and pick the Branch.
  5. Click Continue.
  6. Enter the six-digit Fatoora code. See Get the Fatoora code.
  7. Click Connect.

Step 1 of the Connect to ZATCA dialog

If your organisation is a member of a VAT group, step 1 also asks for Unit Name (Seller TIN): your own 10-digit Tax Identification Number.

Result. "Connecting to ZATCA — this usually takes a few minutes." Clix sends a signing request to ZATCA with your code and stores the certificate ZATCA issues. The connection goes through Setup in Progress and Pending Activation to Active. Once it reads Active, you can issue invoices through it.

Connect to ZATCA, set up the connection, and link it with a Fatoora code; the connection then moves from Setup in Progress to Pending Activation to Active Connect to ZATCA, set up the connection, and link it with a Fatoora code; the connection then moves from Setup in Progress to Pending Activation to Active

Get the Fatoora code

Who. Whoever holds your ZATCA taxpayer login.

Step 2 of the dialog, Link with ZATCA, lists these steps and has an Open Fatoora Portal button.

  1. Open the Fatoora portal and sign in with your ZATCA credentials.
  2. Choose Onboard New Solution Unit.
  3. Generate a code.
  4. Enter it in Clix within one hour.

The code lasts one hour

"The 6-digit code expires 1 hour after you generate it." If connecting fails, generate a fresh code rather than reusing the old one.

See a connection's details

  1. On the connection's row, click the ⋯ button.
  2. Click More Details.

the More Details panel of a connection

The panel shows Industry, Unit Name, Created at, Certificate valid from, Certificate valid until, Issued invoices & notes and the Serial number. Keep the serial number for support requests.

If a branch link failed, the same menu shows Retry link. It sends the branch you chose again. Every role sees it, but only an Admin's click works.

Renew a certificate

What it is. Each connection has a certificate from ZATCA, its digital identity card (ZATCA calls it a CSID). The certificate is valid until a fixed date. Renewing gets the connection a new certificate before or after the old one runs out. See Certificates.

Why. An expired certificate stops invoicing through that connection. ZATCA's Fatoora portal is where a unit's cryptographic stamp identifier is generated, renewed or revoked (E-Invoicing Detailed Guidelines §2.8, p. 10). A new stamping key must be generated when the identifier is renewed (Implementation Resolution, Annex 1, Cryptographic Stamp, p. 12); Clix does this for you.

Who. Admin.

Clix checks certificates every day and emails your Admins when one is within 30 days of expiry or has expired. One email lists every connection affected. The Compliance tab counts them under Expiring Soon and Expired.

  1. On the connection's row, click the ⋯ button.
  2. Click Renew certificate. It appears only when the certificate expires within 30 days or has expired.

Result. "Certificate renewal started — the status will update shortly." No Fatoora code is needed.

Every role that opens ZATCA Connections sees Renew certificate, but Clix accepts the renewal only from an Admin. For anyone else it shows "We couldn't start the renewal. Please try again." Trying again does not help: ask an Admin.

What an expired certificate breaks

Invoices cannot be signed or submitted through a connection whose certificate has expired. Issued invoices are unaffected: they stay cleared or reported. You cannot issue new ones through that connection until it is renewed.

Where next. Certificate expiry · What each connection status means

ZATCA sources

ZATCA publishes each text in Arabic and English; where they differ, the Arabic prevails.

  • E-Invoicing Detailed Guidelines, version 2, May 2023: §2.8, p. 10 · Arabic
  • E-Invoicing Implementation Resolution (controls, requirements and technical specifications), 2023: Annex 1, p. 12 · Arabic