Registration and tokens
FBR Digital Invoicing Registration: IRIS, Sandbox and Production Tokens
Follow the official onboarding sequence from IRIS and integration-mode selection through technical details, sandbox scenarios and production access.
Follow the official onboarding sequence from IRIS and integration-mode selection through technical details, sandbox scenarios and production access.
Begin inside IRIS
The public Digital Invoicing User Manual starts with the taxpayer logging into IRIS and opening Digital Invoicing. The integration-mode screen presents API Integration and Manual Invoice Generation. For API integration, the taxpayer selects the applicable licensed-integrator route. Never give IRIS passwords or API tokens to an unverified party or submit them through a public contact form.
Prepare technical details before applying
The manual lists a technical contact, mobile number, email, ERP or system provider, cloud or on-premises software details, version, support user details, business nature and sector. Gather this information before starting. Use a monitored business email and document who is authorised to change the configuration.
Understand IP whitelisting
For the PRAL path described by the manual, taxpayers provide hosting-company and country details plus one or more IP addresses, or upload the prescribed file for multiple IPs. A dynamic office connection is not a substitute for a controlled server address. Coordinate hosting, firewall and failover plans before whitelisting.
Complete representative sandbox scenarios
Sandbox is a testing environment, not a production approval guarantee. The manual says scenario-based invoices should align with the selected business nature and sector. Test buyer types, products, rates, UOMs, discounts and less common transactions that actually occur. Save request and response logs without exposing credentials.
Move to production deliberately
The manual describes production details and a production security token after required scenario testing. Treat the token as a secret: store it server-side, limit access, rotate it when required and never place it in browser code, screenshots or support emails. Rehearse error handling and daily reconciliation before sending live invoices.
Official sources and review note
- FBR/PRAL Digital Invoicing User Manual
- FBR Digital Invoicing FAQs
- FBR Digital Invoicing Technical Assistance
Reviewed against these public sources on 21 October 2026. This article is educational information, not tax or legal advice. Confirm the latest law, notifications, technical documents and professional advice applicable to your business.