webkoding
integration.webkodingtheme.comLive
The FatooraPro dashboard: invoices submitted to ZATCA, how many cleared, how many failed, and the certificate and environment the store is running against.Open the live demo →

No signup. Try it with a test card; the demo resets itself regularly.

Saudi Arabia requires every invoice to be cleared or reported to ZATCA, cryptographically signed, hash-chained to the one before it, and carrying a specific QR code. Getting any of it slightly wrong means the invoice is rejected.

FatooraPro does the whole flow — CSR, compliance, production certificate, clearance and reporting — and was verified end to end against ZATCA’s own sandbox before it was sold to anyone.

What you get, before you pay

Everything in the box, so there is nothing to discover after checkout.

Files

  • fatoorapro.zip, installed from the WordPress admin
  • Unminified source, no obfuscation
  • Changelog and sample data

Licence

  • 1 WordPress site
  • Licence key sent by email after payment
  • GPL v2 or later

Updates and support

  • 1 year of updates and email support
  • After that the software keeps working
  • Renew only if you want new versions

Requirements

  • WordPress 6.0+
  • WooCommerce 7.0+
  • PHP 7.4+
  1. 1
    Onboard with ZATCA

    CSR, then the compliance CSID, then the production CSID. The plugin walks the sequence.

  2. 2
    Sign and chain

    UBL 2.1 invoices with XAdES-BES, the PIH hash chain and the invoice counter.

  3. 3
    Clear or report

    B2B invoices are cleared, B2C invoices reported, each with the TLV QR code.

What it does

  • B2B clearance and B2C reporting
  • UBL 2.1 invoices with XAdES-BES signing
  • PIH hash chain and invoice counter
  • ZATCA-compliant TLV QR code
  • Onboarding: CSR → compliance CSID → production CSID
  • Verified against the ZATCA sandbox

What you need

  • WordPress 6.0 or newer, WooCommerce 7.0 or newer, PHP 7.4 or newer
  • A ZATCA taxpayer account and your VAT registration details
  • OpenSSL available in PHP — the CSR, the certificates and the XAdES-BES signing all need it
  • Outbound HTTPS from your server to ZATCA’s endpoints

Why this exists

What FatooraPro does not do

  • It does not give you a ZATCA certificate. It generates the CSR and walks the onboarding; the certificate belongs to your taxpayer account.
  • It is not accounting software and does not file your VAT return.
  • It covers Saudi ZATCA Phase 2 only. The UAE is a different regime and a different product.
  • It cannot fix invoices altered outside the plugin. The hash chain is the point: break it and the invoices after it are rejected.

Questions

What is the difference between ZATCA Phase 1 and Phase 2, and which one does FatooraPro cover?

Phase 1 (Generation, from December 2021) requires invoices to be produced electronically with a TLV QR code printed on them; nothing is sent to ZATCA. Phase 2 (Integration, rolled out in waves since January 2023, with taxpayers notified by ZATCA wave by wave according to revenue) adds UBL 2.1 XML, XAdES-BES signing, the PIH/ICV chain, clearance of B2B invoices on the Fatoora platform and reporting of B2C invoices within 24 hours. FatooraPro covers Phase 2 end to end, and because a Phase 2 invoice already carries the Phase 1 QR code there is no separate Phase 1 mode to switch on. The current waves are announced by ZATCA.

Was this tested against ZATCA, or only written to the spec?

It was verified end to end against ZATCA’s own sandbox before it was sold to anyone. Given how much of Phase 2 is rejected for small format errors, a plugin that has never completed the flow is not worth installing.

Does it handle both B2B and B2C?

Yes — clearance for B2B and reporting for B2C, which are different flows with different timing, not a setting.

What is the PIH chain and why does it matter?

Each invoice carries the hash of the one before it. If the chain breaks, subsequent invoices are rejected — which is why the counter and the hash are handled by the plugin rather than left to a scheduled job.

Do I need my own certificate?

Yes, and the plugin generates the CSR and takes you through obtaining the compliance and production CSIDs. The certificate belongs to your taxpayer account, not to us.

Where is the QR code specified?

ZATCA specifies a TLV-encoded QR with particular fields. The plugin produces that, not a generic QR of the invoice URL.

Everything else is in the FatooraPro documentation, and anything it does not answer goes to support@webkoding.com.

Not quite it? Three nearby

Not ready to buy?

We will write when there is a new plugin, or a release worth knowing about. A few emails a year, each about something we actually shipped — no offers, no sequence, and your address goes nowhere else.

One click to leave, from any of them. What we do with it.