The provided OTP is invalid in Production

Onboarding, renewal and revocation
1

Hi Zatca Team

One of our client still facing an issue when call the compliance api: https://gw-fatoora.zatca.gov.sa/e-invoicing/core/compliance

As I checked the log of request && response, He receive a response with this message
{“errors”:[{“code”:“Invalid-OTP”,“message”:“The provided OTP is invalid”}]}

He tried more and more times, still receiving same response , even with generating a new OTP with any trying.

Here example of one request && response

`{“method”:“POST”,“headers”:{“Content-Length”:[“1182”],“User-Agent”:[“GuzzleHttp/7”],“Host”:[“gw-fatoora.zatca.gov.sa”],“s-request-id”:[“acd99b60-a152-4bbd-b4c9-2cf2cc7e9d93”],“accept”:[“application/json”],“Content-Type”:[“application/json”],“Accept-Version”:[“V2”],“OTP”:[“245708”]},“uri”:“/e-invoicing/core/compliance”,“version”:“HTTP/1.1”,“body”:{“csr”:“LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1VUQ0NBZmNDQVFBd1NURU9NQXdHQTFVRUF3d0ZVMkZzYkdFeEZUQVRCZ05WQkFvTURITnRZV0ZoWVd4aApZVzVoZVRFVE1CRUdBMVVFQ3d3S01UQXhNRGcwTmpBeU1qRUxNQWtHQTFVRUJoTUNVMEV3VmpBUUJnY3Foa2pPClBRSUJCZ1VyZ1FRQUNnTkNBQVJ6c1RSbllpMmpuSzNHa1ZrbVIxYXBMZHh6YlBKQlV3L1dEdCtTYW4rcWFpMkEKdHJOSzdPWVg3MUVMbDB3NGZlcElvbTFhZXYxQWtZS0wwUjJwaGd5N29JSUJUVENDQVVrR0NTcUdTSWIzRFFFSgpEakdDQVRvd2dnRTJNQ0VHQ1NzR0FRUUJnamNVQWdRVUV4SmFRVlJEUVMxRGIyUmxMVk5wWjI1cGJtY3dnZ0VQCkJnTlZIUkVFZ2dFR01JSUJBcVNCL3pDQi9ERXJNQ2tHQTFVRUJBd2lNUzFUWVd4c1lTMUJjSEI4TWkxVFlXeHMKWVMwMGZETXRNVFl6T0RrNE9URTRPVEVmTUIwR0NnbVNKb21UOGl4a0FRRU1Eek13TWpBd09Ea3lOakV3TURBdwpNekVOTUFzR0ExVUVEQXdFTVRFd01ER0JqVENCaWdZRFZRUWFESUdDdzVqQ3Q4T1l3ckhEbWNLS3c1bkNnaURECm1NS253NW5DaE1PWXdyVERtY0tLdzVqQ3JpRERtTUt0dzVqQ3M4T1p3b1lndzVqQ3FNT1p3b1lndzVqQ3JjT1kKd3JQRG1jS0t3NW5DaGlERG1NS293NW5DaGlERG1NSzV3NW5DaE1PWndvb2dMRGMyTWpnZ05ERTNNU0REbWNLQwp3NWpDc2NPWXdyZkRtTUtvdzVqQ3FURU5NQXNHQTFVRUR3d0VabWx5YlRBS0JnZ3Foa2pPUFFRREFnTklBREJGCkFpRUFnczlMbGYzTVRWT3E1S3pxTUVUZzdBMForME5Fb0I3VUgrK1RpY1AwYWxvQ0lHZG5ERmlQc2wybzViWDkKOW1MeEFESTM2NTU5dlVzU3hZVVAwWFpObW02RQotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K”}}``

Response :

{“headers”:{“Connection”:[“Keep-Alive”],“Date”:[“Sun, 12 Oct 2025 10:52:23 GMT”],“Content-Type”:[“application/json”],“Vary”:[“Origin,Access-Control-Request-Method,Access-Control-Request-Headers”],“X-Content-Type-Options”:[“nosniff”],“X-XSS-Protection”:[“1; mode=block”],“Cache-Control”:[“no-store, max-age=0”],“Pragma”:[“no-cache”],“Expires”:[“0”],“Strict-Transport-Security”:[“max-age=15724800; includeSubDomains”],“X-Frame-Options”:[“DENY”],“Content-Security-Policy”:[“default-src ‘none’; script-src ‘self’; connect-src ‘self’; img-src ‘self’; style-src ‘self’; frame-ancestors ‘none’; form-action ‘self’”],“X-Global-Transaction-ID”:[“16e49af368eb88661e6931cf”],“Set-Cookie”:[“TS01689bcc=0132a679c09a4bacd59f0aca0cc1b1eff9c50717a16c35b88fb5ded9bc35e3ada6cf3aa29b98a58583c830f9fa900fd7951bf11d8e; Path=/; Domain=.gw-fatoora.zatca.gov.sa;”],“Transfer-Encoding”:[“chunked”]},“status_code”:400,“version”:“HTTP/1.1”,“message”:“Bad Request”,“body”:{“errors”:[{“code”:“Invalid-OTP”,“message”:“The provided OTP is invalid”}]}}

```

2

are you sure you using a valid production otp for the same company ?

3

1-Check that the VAT number in the CSR request is the same VAT number used to request the OTP.

2-Verify the OTP’s validity as it expires after 1 hour from the time of generation.

3-make sure to generate the OTP from the correct Portal/environment you want to use.
If using Simulation APIs, generate the OTP from the Simulation portal.
If using Fatoora APIs ( Core ), generate the OTP from the Fatoora portal.