# Steps to get Username and password generated to reporting invoice

**URL:** <https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031>\
**Category:** Signing process\
**Created:** [September 15, 2024, 9:19am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031 "2024-09-15T09:19:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ahmedtaher](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@ahmedtaher](https://zatca1.discourse.group/u/ahmedtaher)\
**Post date:** [September 15, 2024, 9:19am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/1 "2024-09-15T09:19:24Z")

</div>

Hello,  
Now I am at the beginning of send invoices with platform  
I need steps to start obtaining the username and password generated binarySecurityToken and secret that I will use to send the invoice.  
How can I extract and use the CSR certificate?  
Thank you all.

---

<div class="post-metadata">

**Author:** ![lalomar](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@lalomar](https://zatca1.discourse.group/u/lalomar)\
**Post date:** [September 15, 2024, 11:17am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/2 "2024-09-15T11:17:18Z")

</div>

Hi @ahmedtaher ,

Thank you for reaching out,

Kindly find below the process for onboarding using JAVA SDK.

1. Download the SDK through this link [here](https://sandbox.zatca.gov.sa/downloadSDK)
2. Prepare your configuration file in SDK/Data/Input directory, you can refer to Technical Guideline, _**3.3.3. Sending a Certificate Signing Request (CSR) in order to receive a Compliance CSID**_ section for more information regarding the CSR input
3. Open CMD in the above file Path and run CSR generation command depending on which environment you want to generate CSR for.

- For Production:  
**Fatoora -csr -csrConfig _“Properties file.properties”_**

- For Simulation:  
**Fatoora -sim -csr -csrConfig _“Properties file.properties”_**

1. You need to send the generated CSR to Compliance CSID API, you will include the generated CSR in the request body along with an OTP (obtained from Fatoora portal), and Accept-Version with value “V2” in the headers.  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/850e83f41d06fab6d547a5177e2002fd127dd71f.png)  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/5956b9ec122c571823e2a19a4d103a00399b9d8e.jpeg)  
The response will be similar to the below:  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/605406580f6c9aaaaf64c3a8e7bfcf00875187ab.png)

- **RequestId:**  
will be submitted in the PCSID generation API, it’s a unique ID for each compliance CSID.

- **BinarySecurityToken**  
This is the Compliance certificate encoded in base64 and to use it to sign the invoices (simplified) and generate a hash (standard). You first need to decode it and put it in the cert.pem file of SDK found in SDK/Data/Certificates folder  
NB: after the Token is decoded it will be in X509Certificate format.  
Also, this token will be used as it is encoded in base64 as username in authorization as Basic Auth in the next 2 APIs (Compliance check, PCSID generation API).

- **Secret**  
This one will be used as a password in authorization as Basic Auth in the next 2 APIs (Compliance check, PCSID generation API).

1. Now you can start the Compliance Check, in the compliance check steps, you need to submit sample invoices. in this steps, you will either send 3 invoices or 6 invoices based on _invoiceType_ filed in the configuration file.

- If the value is 1000 =\> You will send standard invoices (standard invoice, standard credit, standard debit).
- if the value 0100 =\> You will send simplified invoices (simplified invoice, simplified credit, simplified debit).
- If the value 1100 =\> You will send standard and simplified invoices(standard invoice, standard credit, standard debit, simplified invoice, simplified credit, simplified debit).  
NB: You can use sample invoices from SDK/Data/Samples.

before sending the invoices you need to sign the simplified invoice first using this command:  
**Fatoora -sign -invoice “invoice.xml”**  
This will generate new invoice file with suffix “\_signed” has new QR, Hash & signature tags.  
and for standards invoices you need to generate hash using this command:  
**Fatoora -generateHash -invoice “invoice.xml”**  
You will have to take the hash value from the CLI and replace the first digest value in the invoice with the new generated Hash.

Now you need to send the request, in the Authorization Tab, we will use the BinarySecurityToken & secret obtained from the previous steps.

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/52be2e575231bfa61d36c4022b049a7190951cf5.png)

Headers:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/9c5ae8a95c4d074ab6dd53a8dfd7fa8c87b34e56.png)  
And the body will be the invoice itself  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/3dab792fd726adcbadbf19345bafdeb6b3768f2b.png)  
To convert the XML file to JSON you can do so using this command

**Fatoora -invoiceRequest -invoice “_invoice.xml_”**

1. After completing the compliance checks, you now need to generate Production CSID. In order to do so, you need to send the requestID returned from CCSID API mentioned in the fourth step in the body.  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/7a21acd65173efbc5e1ba45036601e2a268df40a.png)

Headers:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/8c808f07600b40e407fc6a929ca6d91c1074015f.png)

In Authorization (the BinarySecurityToken and secret returned from first API)

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/zatca1/original/1X/be73592839f7fdbe756aa2e3de4992e79a0eaee5.png)

In the response you will get the BinarySecurityToken and Secret, and you will use it to submit invoices to ZATCA.

-Below are more references that might help you:

- [Educational Library](https://zatca.gov.sa/en/E-Invoicing/Introduction/Guidelines/Pages/default.aspx)
- [Developer Portal](https://sandbox.zatca.gov.sa/)
- and you can find the endpoints in Fatoora portal

---

<div class="post-metadata">

**Author:** ![ahmedtaher](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@ahmedtaher](https://zatca1.discourse.group/u/ahmedtaher)\
**Post date:** [September 17, 2024, 10:20am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/3 "2024-09-17T10:20:07Z")

</div>

Thankyou @lalomar for replay

now after generate csr by sdk and call compliance api get binarySecurityToken and secret but when use it in Header Authorization reporting invoice api get 401 not authorized

i’m tried base64\_encode(binarySecurityToken . secret) and base64\_encode(binarySecurityToken . ‘:’ . secret) and binarySecurityToken . ‘:’ . secret but all attempts failed.

---

<div class="post-metadata">

**Author:** ![lalomar](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@lalomar](https://zatca1.discourse.group/u/lalomar)\
**Post date:** [September 17, 2024, 11:04am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/4 "2024-09-17T11:04:03Z")

</div>

You should use the BinarySecurityToken and Secret as it is without encoding in the Authorization of your request, with Basic Auth

---

<div class="post-metadata">

**Author:** ![ahmedtaher](https://avatars.discourse-cdn.com/v4/letter/a/a9a28c/32.png) [@ahmedtaher](https://zatca1.discourse.group/u/ahmedtaher)\
**Post date:** [September 18, 2024, 9:05am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/5 "2024-09-18T09:05:41Z")

</div>

$headerData = array(

```
        'Authorization: Basic ' . $binarySecurityToken . ':' . $secret,
        'Accept-Version: V2',
        'Accept-Language: en',
        'Clearance-Status: 0',
        'Content-Type: application/json'

    );

```

But get 401, decoded by base64 also get 401

---

<div class="post-metadata">

**Author:** ![lalomar](https://avatars.discourse-cdn.com/v4/letter/l/5e9695/32.png) [@lalomar](https://zatca1.discourse.group/u/lalomar)\
**Post date:** [September 18, 2024, 9:54am UTC](https://zatca1.discourse.group/t/steps-to-get-username-and-password-generated-to-reporting-invoice/3031/6 "2024-09-18T09:54:57Z")

</div>

Can you please check the below:

**1- CSR Request** : Double-check that you’ve used the correct command to configure the CSR (Certificate Signing Request) based on the environment you intend to use.

- Using the **SDK** and config.properties to generate the CSR :  
**Simulation portal commad :**  
`fatoora -sim -csr -csrConfig "configfile.properties path file"`  
**Fatoora portal command:**  
`fatoora -csr -csrConfig "configfile.properties path file"`

- Using openssl and config.cnf file to generate the CSR:  
the config.cnf file in **Simulation** should contain :  
`certificateTemplateName = ASN1:PRINTABLESTRING:PREZATCA-Code-Signing`  
the config.cnf file in **Fatoora** should contain :  
`certificateTemplateName = ASN1:PRINTABLESTRING:ZATCA-Code-Signing`

**2- API Endpoint** : Ensure that you are using the correct APIs for the correct Environment you want to use.  
e.g :  
If using Simulation Env, use the Simulation portal to get the OTP and Simulation APIs to get the CCSID and PCCSID

**3- Valid Credentials** : Ensure that you are using the correct credentials for the correct environment for example you should not use the Simulation Certificates on production and vice versa.

Please let us know if you have verified all of the above and still encountering the “401 Unauthorized” error.