FBR IRIS registration for digital invoicing

1. Log into IRIS and open Digital Invoicing. You choose an integration mode: connecting a system through the API, or generating invoices manually in the portal.
2. Choose your connection to FBR. PRAL, or another licensed integrator. The two paths behave differently from here — the PRAL route is largely automatic, while a third-party integrator involves that firm in issuing your credentials.
3. Submit technical details, including the IP address you will send from. This is the step that stops projects. On-premise systems need a static public IP from the ISP, and it has to be whitelisted before anything works. It is also the only step in the whole process with a published turnaround: up to two working hours, after which sandbox testing enables itself. Cloud-hosted systems need their outbound address pinned rather than floating.
4. Declare your business nature and sector. Two controls on the same screen — business nature allows several selections, sector allows exactly one. They exist only to decide which sandbox test scenarios you are given, and they are worth getting right, because they determine how much testing you have to do.
5. Clear the sandbox scenarios you were assigned. See the sandbox guide for how allocation works and why the commonly quoted “28 scenarios” is misleading.
6. Receive the production token. On the PRAL path this is issued automatically once your test invoices succeed — there is no review queue and no human sign-off. The token is a static credential valid for five years and tied to one registration number, so a group with several registrations needs one per entity.

Two things that cost people days

Support during sandbox runs is not in IRIS. FBR runs a separate support portal for digital invoicing, with its own login. Teams routinely raise issues in the wrong place, or never discover it exists. Ask for the support portal details at the same time you submit technical details.

The wrong token fails as an authorisation error, not a data error. Because the token is tied to one registration, using another entity’s token returns an access failure that reads nothing like the mapping problem people go looking for.