What is a ZATCA CSID? The cryptographic stamp identifier explained for business owners

If your business is heading into Phase 2 of e-invoicing, you will meet the term ZATCA CSID very quickly. CSID stands for Cryptographic Stamp Identifier, and it is the digital certificate that lets your invoicing system prove to ZATCA that an invoice genuinely came from you. Without one, your system cannot stamp a simplified invoice and cannot talk to the Fatoora platform at all.

This guide explains the CSID in plain business language: what it is, how you obtain it, how many your company needs, and what happens when one expires. Every rule below comes from ZATCA's published guidelines, linked at the end.

What a CSID actually is

ZATCA defines a Cryptographic Stamp Identifier as a unique identifier that links the e-invoice solution unit to a trusted third party able to confirm the identity of the person subject to the E-Invoicing Regulation. In technical terms it is a cryptographic certificate: an electronic document that proves ownership of a public key and is used for authentication and signing.

The useful mental picture is a sealed identity card issued to one piece of invoicing equipment, not to your company as a whole. ZATCA's technical guideline is explicit that a CSID uniquely identifies an invoice generation solution unit associated with a taxpayer, for two jobs: cryptographically stamping simplified B2C invoices, and accessing the Reporting and Clearance APIs.

Each certificate comes with a private key, and that key is what actually creates the cryptographic stamp. ZATCA requires the key to be generated inside the solution so that it cannot be viewed or copied, and requires vendors to block the export of stamping keys using a key vault. Export of the key would let someone steal your invoicing identity, which is why the regulation also obliges you to preserve CSIDs safely and never use them for another purpose.

Why the CSID only appears in Phase 2

In Phase 1, the Generation Phase, no cryptographic stamp was mandated and no device registration was required. You simply had to issue structured electronic invoices from a compliant solution with a QR code on simplified invoices.

Phase 2, the Integration Phase, changed the picture. ZATCA's own comparison tables state that in Phase 2 compliant solutions must be registered on the Fatoora portal through the onboarding process, and that the cryptographic stamp becomes mandatory. Your solution must stamp the XML using a CSID issued by ZATCA and add a Phase 2 QR code carrying 9 tags in TLV base64 format.

Phase 2 arrives in waves. ZATCA has announced that taxpayers whose revenues subject to VAT exceeded 187,500 riyals during 2022, 2023, 2024 or 2025 fall into the twenty-fifth wave, and that it will notify them to integrate their solutions with the Fatoora platform by no later than 1 February 2027. If that sounds like your business, our explainer on ZATCA Wave 25 sets out the criteria in full.

How your business gets a CSID, step by step

Onboarding starts on the Fatoora portal and finishes inside your invoicing software. Most of it runs automatically; the part you do by hand takes a few minutes per unit.

1. Sign in to the Fatoora portal at fatoora.zatca.gov.sa with your ZATCA taxpayer portal credentials.
2. Choose to onboard a new solution unit or device, and enter how many one time passwords you need, one per unit. A single request can produce up to 100 OTP codes.
3. The portal displays the codes. Each OTP is valid for 1 hour from the moment it is generated.
4. Enter each OTP into the matching invoicing unit inside that hour.
5. The unit builds a Certificate Signing Request, sends it, and receives a Compliance CSID.
6. The unit runs ZATCA's compliance checks by itself, and on success receives its Production CSID.
7. Go back to the portal and open the list of onboarded solutions and devices to confirm the unit is there and active.

There are two ways to handle the OTP: read the codes on the portal and type them into your units, which lets you onboard several in one visit, or let your solution collect a single code automatically for one unit.

Compliance CSID and Production CSID: two different certificates

Two certificates appear during onboarding, and owners often mix them up. The Compliance CSID is temporary. It is issued once your Certificate Signing Request is accepted, and it exists only so the unit can sit the exam.

The unit then submits sample documents for validation. If the request declared invoice type 1000, it sends a standard tax invoice, a standard debit note and a standard credit note. If it declared 0100, it sends the three simplified equivalents.

Once every test passes and the compliance flag is set, ZATCA's certificate authority issues the Production CSID. That is the real certificate, the one that authenticates your unit against the core e-invoicing APIs. If a test fails or does not complete, the unit has to restart from a fresh OTP and a fresh request. ZATCA lists invalid documents or inputs, and a missing, invalid or expired Compliance CSID, among the usual causes of failure.

One more thing worth knowing before you test anything: the Fatoora production portal and the Fatoora simulation portal are two independent environments, and devices are onboarded to each separately. A unit that works in simulation still has to be onboarded in production.

How many CSIDs does your business need?

This question decides the size of your project, and ZATCA answers it by invoicing structure rather than company size. The rule of thumb: every device issuing invoices under the same VAT number must be registered.

Count your units honestly before you start. A retailer with 40 tills and a restaurant group on one cloud system face very different onboarding days.

Renewal, revocation and expiry

A CSID is generated once during onboarding, not once per invoice, and ZATCA states that it then remains valid for multiple years. The exact certificate expiry date for each unit is shown in the Fatoora portal list, next to a status of active, expired or revoked.

Renewal follows the same path as first time onboarding, with one difference: the existing CSID is revoked and a new one issued in its place. Start renewal before the expiry date, because an expired certificate stops the unit submitting anything to ZATCA.

You may also need to revoke a CSID yourself. ZATCA lists the reasons: the private key or the unit is believed to be compromised, the unit is discontinued, sold or transferred to another taxpayer, the information in the CSID turns out to be inaccurate, the unit is lost, stolen or damaged, an unauthorised onboarding is discovered, or the unit goes through a major upgrade. You do this from the same list of onboarded devices in the portal.

ZATCA can revoke a CSID without being asked, too. Deregistration from VAT, or suspension because the business joined a VAT group, triggers automatic revocation. And once a device has been revoked it cannot simply be switched back on, it has to be onboarded again as a new device.

A short checklist before your integration date

• Confirm your wave and integration date on the ZATCA website, and diarise it.
• List every unit that issues invoices: servers, tills, branch systems, mobile apps.
• Decide, using the table above, which units actually need their own certificate.
• Check that your ZATCA taxpayer portal credentials work before onboarding day.
• Book a window where someone can enter OTP codes within the hour they are valid.
• Record each unit's certificate expiry date and set a reminder two months earlier.
• Agree with your vendor who renews certificates and who is called when a stamp fails.

How Daftarix handles the CSID side for you

Daftarix is business software for Saudi companies, and its Fatoora integration covers onboarding and CSID as part of the product rather than as a separate technical project. The invoicing side generates XML with a cryptographic stamp, handles clearance for B2B tax invoices, and reports B2C invoices within 24 hours.

The flow is a simple one: check your wave, onboard Daftarix, invoice as usual, then clear or report. Quotations carry through to Fatoora, and invoice questions are answered by support teams working in Arabic and English. That keeps the certificate work in the background instead of on your finance manager's desk.

If your integration date is approaching and you want to see how onboarding would look for your own units, book a demo and we will walk through it with your branch structure.

Frequently asked questions

Is a CSID the same thing as the cryptographic stamp?

No. The cryptographic stamp is the electronic seal applied to the invoice data to prove its origin and integrity. The CSID is the certificate that identifies the unit applying that stamp, and it is tied to the private key that produces it.

Do I need a new CSID for every invoice?

No. ZATCA is clear that a CSID is generated only once during onboarding and then remains valid for multiple years. Your software reuses the same certificate for every invoice that unit issues until it expires or is revoked.

My OTP expired before I could use it. What now?

Generate a new one. OTP codes last 1 hour from generation, and an expired or invalid code is one of the routine reasons an onboarding attempt fails. Simply return to the Fatoora portal and request another code for that unit.

Can one CSID cover all my branches?

Only if the invoices are signed in one place. If each branch POS signs and sends its own invoices, every one of those devices needs a certificate. If branch terminals pass invoices to a server that stamps them, the certificate sits on the server instead.

What happens to my CSIDs if I join a VAT group?

Suspension of the VAT registration on joining a VAT group triggers automatic revocation of the associated CSIDs by ZATCA. You would then onboard your units again under the arrangement that applies to the group.

Sources: ZATCA, E-Invoicing Detailed Technical Guideline, and ZATCA, E-Invoicing Detailed Guideline. Where a figure here ever differs from those documents, the official documents prevail.