# CSR and Private key generation **URL:** \ **Category:** SDK, web-based validator and sandbox\ **Created:** [October 22, 2023, 9:37pm UTC](https://zatca1.discourse.group/t/csr-and-private-key-generation/874 "2023-10-22T21:37:35Z")\ **Posts on this page:** 1\ **Page:** 2
**Author:** ![Ali00032](https://avatars.discourse-cdn.com/v4/letter/a/ad7895/32.png) [@Ali00032](https://zatca1.discourse.group/u/Ali00032)\ **Post date:** [June 16, 2025, 1:14pm UTC](https://zatca1.discourse.group/t/csr-and-private-key-generation/874/21 "2025-06-16T13:14:26Z")
Dear eCloud Team, I hope you’re well. ✅ Could you please clarify the following points? * * * **1️⃣ Why is the OTP we received from the Simulation Portal invalid when we use it in api end point of simulation?** * * * **2️⃣ Do we need to generate a new OTP each time we want to connect to the Simulation Portal, or can we reuse a previously generated OTP?** * * * **3️⃣ Are there any specific conditions or configuration settings we should be aware of when applying for an OTP on the Simulation Portal (such as a minimum wait time, expiration, or usage limits)?** * * * **Additionally:** When we send the **request ID** on here: [https://gw-fatoora.zatca.gov.sa/e-invoicing/developer-portal/production/csids](https://gw-fatoora.zatca.gov.sa/e-invoicing/developer-portal/production/csids) We get back a **binarySecurityToken** and a **secret** in the response. ✅ Could you please clarify which of these is considered the CSID? * * * **Lastly:** We successfully generated the XML invoice according to ZATCA’s standards. ➥ Could you please explain in detail how the signing process works after this point — How we should use our private key and certificate to sign the invoice and submit it to ZATCA? * * * Your guidance on these points would be greatly appreciated, as we want to make sure we follow ZATCA’s procedures accurately. Looking forward to your kind response. Best wishes, [Previous page](https://zatca1.discourse.group/t/csr-and-private-key-generation/874.md?page=1)