Who should own your IRIS and FBR credentials

Answer first. The business should own every credential behind its FBR digital invoicing. Employees and vendors may use them, but none of them should be the only one who holds them. In practice that means the IRIS login sits with an authorised person of the business, the one-time codes go to a company phone number and a shared company inbox, the production token is kept inside the invoicing system rather than in email, and the IP address FBR has whitelisted is written down with the name of whoever controls it. Each item gets a named backup. When someone leaves, you work through a short list the same day.

What actually needs an owner

People talk about “the IRIS password” as if there were one. A business that files e-invoices has at least six things to look after, and they fail in different ways.

FBR also runs a separate support portal for digital invoicing, with its own login. Add it to the list. Teams often find out it exists only after raising a sandbox problem in the wrong place.

Why the token matters most

The production token is the credential most businesses look after least, and it matters most. It is a fixed credential, valid for five years, and it is tied to one registration number. Anything that holds it can send invoices to FBR under your registration.

That has two results. First, a token that sits in an old email thread or a developer’s notes is a live key to your sales tax record for years. Second, if it is lost or exposed, every system that uses it has to be updated at once, so you need to know where it is used.

The token is also easy to mix up in a group. Because it belongs to one registration, using another company’s token fails as an access error. That reads nothing like a data problem, and teams can lose a day looking for a mapping mistake that is not there.

Setting it up right the first time

Most of this costs nothing if it is done at the start, and a lot if it is fixed later.

1. Decide the authorised person. Agree who is legally allowed to act for the business in IRIS, and who covers them. Write both names down.
2. Move the codes to company channels. Make sure IRIS sends its one-time codes to a company-owned number and a shared inbox that more than one person can see.
3. Plan the IP address early. When you enrol, you give FBR the IP address you will send from. A system on your own premises needs a static public IP from your internet provider. A cloud system needs a fixed outgoing address. Ask for it before you enrol, because whitelisting comes before anything else works. Once submitted, FBR states a turnaround of up to two working hours.
4. Keep sandbox and production apart. Store them in separate places with clear labels. The test scenario ID that sandbox requires is rejected in production, so a mixed-up setup fails on the first live invoice.
5. Put the token where it is used. Enter it straight into the invoicing system. Do not email it, paste it in a chat or keep it in a spreadsheet.
6. Record it. Add each item to the credential register below, with the date it was set up.

What to give your software vendor

Software that files invoices for you needs your FBR token. It does not need your IRIS password or your one-time codes, and a vendor who asks for them is asking for more than the job requires.

In eInvoicePro, the seller’s FBR token is saved once against their NTN or CNIC. It is stored encrypted and can be saved or replaced, but it is never shown back, not even to the account that saved it. The API only says whether a sandbox and a production token exist. That means a team member who can send invoices cannot copy the token out of the system.

Whatever software you use, ask the vendor three questions in writing: where the token is stored, who at the vendor can see it, and how you replace it if you need to.

Groups, branches and CA firms

Groups with several registrations. Each registered company needs its own token. Keep one row per registration in the register, and label every system with the registration it files for.

Branches. Branches of one registered business file under the same registration, so they share its token. What they should not share is user accounts. Give each branch its own users in the invoicing software, so you can see who made which invoice.

CA firms acting for clients. A firm that handles a client’s IRIS work should have a written authority from the client, and the client’s own authorised person should still hold the login. If the firm runs the client’s invoicing, the token goes straight into the software. It should never sit in the firm’s files. Our playbook for CA firms covers running many clients at once.

When someone leaves

Staff changes are when credentials go missing. Work through this list on their last day, before anything has a chance to break.

• Change the IRIS password if they knew it, and check the registered mobile and email are still company-controlled.
• Remove their user from the invoicing software and from FBR’s support portal.
• Check who else can cancel or edit invoices in the portal, so the 72-hour fixes still have an owner.
• If they could see the production token, treat it as exposed. Ask FBR’s digital invoicing support about a replacement, and update every system that uses it.
• Update the credential register with the new owner and the date.

The same list applies when you change software vendor or IT company. Get written confirmation that they have deleted any copy of your credentials.

A one-page credential register

Keep the register somewhere finance and IT can both see it. It lists who holds what. It should never contain the passwords or tokens themselves.

Review it every quarter and whenever someone joins or leaves. It takes ten minutes, and it is the first document anyone will ask for when something goes wrong.

FAQs

Who should hold the IRIS login for a company? An authorised person of the business, such as a director or the finance head, with a named backup. The registered mobile number and email should be company-owned, so one-time codes do not go to a personal phone.

Should we give our IRIS password to our software vendor? No. Software that files invoices needs your FBR digital invoicing token, not your IRIS password or one-time codes. Ask the vendor where the token is stored and who can see it.

How long does the FBR production token last? It is a fixed credential valid for five years, tied to one registration number. Note the issue date in your credential register so the renewal does not arrive as a surprise.

Do our branches need separate tokens? Not if they file under the same registration. They share that registration’s token. They should still have separate user accounts in your invoicing software, so you can see who made each invoice.

What should we do if an employee who had the token leaves? Treat the token as exposed. Ask FBR’s digital invoicing support about a replacement, update every system that uses it, change the IRIS password if they knew it, and record the new owner.

Related reading: the IRIS registration guide, sandbox to go-live and the eInvoicePro API.