Before any software can send your invoices to FBR, your business needs a Digital Invoicing security token from IRIS. You get a sandbox token first for testing, and a production token once your test invoices pass. This guide follows the screens in FBR’s Digital Invoicing user manual, step by step.
What you need before you start
- An active sales tax registration and your IRIS login (registration number and password).
- The software you will use, for example 3Ace FBR Suite.
- The public IP address of the server that will call FBR. In 3Ace FBR Suite it is shown under Company & FBR, with a copy button.
- A technical contact person (name, email, mobile).
Step 1: Open Digital Invoicing in IRIS
Log in to IRIS with your registration number and password. On the dashboard, choose Digital Invoicing.
Step 2: Choose API Integration
The Integration Mode screen offers two options. Select API Integration so your software can report invoices in real time. The other option, Manual Invoice Generation, is limited and not suited to regular sales.
Step 3: Choose your licensed integrator
Select Proceed with PRAL as Licensed Integrator and press Submit. PRAL (Pakistan Revenue Automation Ltd) is FBR’s own technology company and does not charge for integration. You can also pick another licensed integrator from the list; in that case the remaining menus open after that integrator accepts your application.
Step 4: Enter technical details
Fill in the technical contact, the ERP or software provider, software type and version, then press Next. For PRAL you also select your business nature and sector. These decide which sandbox scenarios you will be asked to pass, so choose carefully.
Step 5: Whitelist your server IP
Under IP Whitelisting, enter the hosting company name, the hosting country and up to three IP addresses (or upload a file for more). PRAL reviews the request, usually within a couple of working hours. Until the IP is accepted, calls from your software will time out or be refused.
Step 6: Get the sandbox token and run your scenarios
Open Sandbox Environment. Here you will find the Web API details, sample JSON and your sandbox security token. Copy the token into your software. In 3Ace FBR Suite:
- Go to Company & FBR, set Environment to Sandbox and paste the sandbox token.
- Press Test token with FBR. “Token works” means the connection is ready.
- Switch on the scenarios IRIS assigned to your business.
- Create and submit one test invoice for each scenario. Each accepted invoice receives an FBR number, and IRIS marks the scenario as passed.
Sandbox invoices are test documents only. In 3Ace FBR Suite they carry the watermark “FBR SANDBOX — TEST ONLY” so they can never be mistaken for real tax invoices.
Step 7: Get the production token and go live
When your required scenarios have passed, IRIS issues the production credentials. Open Production Environment and use View Security Token. Paste it into your software and switch Environment to Production. From that moment every invoice is a live FBR invoice with its FBR number and QR code.
Troubleshooting the connection
| What you see | Likely cause | What to do |
|---|---|---|
| HTTP 401 Unauthorized | Token is wrong, expired or for the other environment | Copy the token again from IRIS and check the Environment setting |
| Timeout or “connection refused” | Server IP not yet whitelisted | Check IP Whitelisting status in IRIS; confirm the IP shown in your software |
| HTTP 500 | Problem on FBR’s side | Wait and retry; invoices stay in the sync queue |
| Error code in the reply | A field in the invoice failed validation | See FBR invoice error codes and fixes |
Keep your token safe
The security token lets software report invoices in your name. Share it only with the software you use, never by public chat or email threads, and replace it in IRIS if you think it has leaked. 3Ace FBR Suite stores tokens securely and never shows them back in full.
Frequently asked questions
How long does it take to get the production token?
It depends on how quickly your IP is whitelisted and your scenarios pass. With clean product data, many businesses finish testing in a few days.
Do I need a new token for each branch?
The token belongs to the registered business. Branches report under the same registration.
Can 3Ace Technologies help with the IRIS steps?
Yes. Our team can sit with you through registration, IP whitelisting and sandbox testing. Start a free trial and contact us on WhatsApp at +92 339 010 5227.
New to FBR e-invoicing? Read the complete FBR Digital Invoicing guide first.
Screens and menu names follow FBR’s Digital Invoicing user manual (v1.5). IRIS may change; follow the current screens if they differ.