FatooraPro documentation
ZATCA Phase 2 e-invoicing for Saudi WooCommerce stores.
Before you start
- WordPress 6.0 or newer, WooCommerce 7.0 or newer, PHP 7.4 or newer
- A ZATCA taxpayer account and your VAT registration details
- OpenSSL available in PHP — the CSR, the certificates and the XAdES-BES signing all need it
- Outbound HTTPS from your server to ZATCA’s endpoints
What it does not do
- It does not give you a ZATCA certificate. It generates the CSR and walks the onboarding; the certificate belongs to your taxpayer account.
- It is not accounting software and does not file your VAT return.
- It covers Saudi ZATCA Phase 2 only. The UAE is a different regime and a different product.
- It cannot fix invoices altered outside the plugin. The hash chain is the point: break it and the invoices after it are rejected.
What is in the download
A WordPress plugin ZIP covering the whole ZATCA Phase 2 flow: onboarding, UBL 2.1 generation, XAdES-BES signing, the PIH chain, the TLV QR code, and clearance and reporting.
GPL source. Nothing is obfuscated, which matters for something your accountant may be asked to explain.
Installing and onboarding
WooCommerce first, then Plugins → Add New → Upload Plugin, activate, and paste the licence key from your purchase email.
Do the onboarding in the sandbox before production. The sequence is CSR, compliance CSID, then production CSID, and each step depends on the one before it — a mistake in the sandbox costs nothing, the same mistake in production costs a support ticket with ZATCA.
Check outbound HTTPS from the server before you start. A host that blocks outbound requests produces failures that look like certificate errors and are not.
Running it in production
Watch the first day of real invoices rather than assuming. Rejections in Phase 2 are usually about a field your shop fills differently from the test data — a missing buyer VAT number on a B2B invoice, most often.
Do not edit invoices outside the plugin once the chain has started. The hash chain is the point: an invoice altered behind its back invalidates the ones after it.
Keep the certificates backed up with the rest of your site. Losing them means re-onboarding, and re-onboarding mid-quarter is not a pleasant afternoon.
Licence, updates and support
- One licence covers 1 WordPress site.
- 1 year of updates, from the date of purchase.
- 1 year of email support.
- Instant download + licence key by email
- 30-day money-back guarantee
Questions this page does not answer go to support@webkoding.com. If you bought from us and cannot find your licence key, look it up here.
Common questions
Was this tested against ZATCA, or only written to the spec?
It was verified end to end against ZATCA’s own sandbox before it was sold to anyone. Given how much of Phase 2 is rejected for small format errors, a plugin that has never completed the flow is not worth installing.
Does it handle both B2B and B2C?
Yes — clearance for B2B and reporting for B2C, which are different flows with different timing, not a setting.
What is the PIH chain and why does it matter?
Each invoice carries the hash of the one before it. If the chain breaks, subsequent invoices are rejected — which is why the counter and the hash are handled by the plugin rather than left to a scheduled job.
Do I need my own certificate?
Yes, and the plugin generates the CSR and takes you through obtaining the compliance and production CSIDs. The certificate belongs to your taxpayer account, not to us.
Where is the QR code specified?
ZATCA specifies a TLV-encoded QR with particular fields. The plugin produces that, not a generic QR of the invoice URL.