How to Get the PRAL API Token: Step-by-Step FBR Setup

To transmit invoices to FBR through the Digital Invoicing API, your business needs a security token issued by PRAL (Pakistan Revenue Automation (Pvt.) Ltd, FBR's IT arm). Tokens are issued through the Digital Invoicing enrolment on IRIS, FBR's online portal. This guide walks through the process.

Prerequisites: Before You Start

You will need the following:

Step-by-Step: Getting the Tokens

Step 1: Log in to IRIS

1. Open https://iris.fbr.gov.pk in your browser
2. Enter your IRIS user ID and password and sign in
3. Confirm that the business name and NTN shown are correct

Step 2: Open Digital Invoicing and choose the integration mode

1. Open the Digital Invoicing section
2. Choose API Integration (for businesses using invoicing software such as FinSmart)
3. Choose your Licensed Integrator: PRAL provides integration and sandbox testing free of cost, or you can select another FBR Licensed Integrator. FinSmart connects through the PRAL API.

Step 3: Enter technical details, business nature and sector

1. Fill in the technical contact person, mobile and email
2. Enter the software type and version (FinSmart gives you these)
3. Tick your business nature (manufacturer, importer, exporter, distributor, wholesaler, retailer, service provider, other; more than one is allowed)
4. Select one sector (for example FMCG, pharmaceuticals, textile, steel, services, or all other sectors)

Business nature and sector decide which sandbox scenarios you must pass. Choose them carefully.

Step 4: IP whitelisting

1. Enter the server IP addresses that will call the API (FinSmart provides these)
2. Submit the application
3. Once PRAL accepts the IPs, the sandbox environment opens

Step 5: View the sandbox token

1. Open the Sandbox Environment step
2. Click View Web API Environment Details
3. The pop-up shows the sandbox endpoints and the sandbox security token
4. Share it with the FinSmart team through the onboarding channel agreed with you, not by open email or chat

Step 6: Pass the eligible sandbox scenarios

The sandbox dashboard on IRIS lists your eligible scenarios and shows which are successful, pending or unsuccessful. Submit an invoice for each eligible scenario until all of them show Successful. See the sandbox scenarios guide.

Step 7: Get the production token

1. When every eligible scenario has passed, IRIS generates the production token automatically
2. Open the Production Environment step and click View Security Token
3. Pass it to the FinSmart team through the agreed onboarding channel; it is stored separately from the sandbox token

Keeping Your Tokens Safe

Do:

• ✓ Treat the token like a password; anyone holding it can post invoices in your name
• ✓ Keep it only where it is needed. FinSmart stores each business's tokens server-side and uses them only on the server; they are never sent to the browser
• ✓ Limit IRIS access to the people who manage your enrolment
• ✓ Keep the sandbox and production tokens clearly separated

Do not:

• ✗ Paste the token into open email threads, group chats or documents
• ✗ Publish it in code repositories or screenshots
• ✗ Hand the production token to anyone who has not completed your onboarding

Configuring FinSmart with Your Tokens

You do not enter tokens in the FinSmart app yourself:

1. The FinSmart team sets up your business and stores the sandbox token (and later the production token) for it
2. You log in and choose Sandbox or Production mode; the server uses the matching token
3. Invoice numbering is kept separate for each mode
4. Every FBR request and response is written to a server-side audit log for your business

Token Maintenance

How long does a token last?

• PRAL's technical documentation describes the token as long-lived (currently five years from issue)
• The IRIS user manual does not describe renewal or regeneration; if a token stops working, raise it with PRAL's Digital Invoicing support

When to act

Troubleshooting: Common Issues

❌ "Digital Invoicing option not visible in IRIS"

Solution:

• Check that your sales tax registration is active on IRIS
• Check the latest FBR notification for your business category on the FBR Notifications page
• Raise a query with PRAL's Digital Invoicing support (DI CRM)

❌ "The API rejects the token"

Solution:

• Make sure the sandbox token is used in sandbox mode and the production token in production mode
• Check that the token was copied in full, with no spaces
• Check that the server IP is whitelisted (when PRAL is your integrator)

❌ "No production token yet"

Solution:

• Open the sandbox dashboard on IRIS and look for scenarios still marked Pending or Unsuccessful
• Fix the error shown in the Error Details pop-up and submit the scenario again
• The production token appears only when every eligible scenario is Successful

Next Steps

Quick Reference: Token Checklist

Before you go live, make sure that:

• ☐ Digital Invoicing enrolment on IRIS is complete
• ☐ Business nature and sector are correct
• ☐ Server IPs are whitelisted (PRAL as integrator)
• ☐ The sandbox token is stored in FinSmart
• ☐ Every eligible sandbox scenario shows Successful on IRIS
• ☐ The production token has been issued and stored in FinSmart
• ☐ Your team knows how to read validation feedback and handle timeouts

Need Help?

Contact FinSmart: info@finsmart.pk | WhatsApp: +92 316 8222144

PRAL Digital Invoicing support: the DI CRM at https://dicrm.pral.com.pk, or the FBR helpline listed on fbr.gov.pk

Related Reading

• Complete FBR Digital Invoicing Guide
• FBR Sandbox Scenarios SN001 to SN028
• FBR Error Code Reference
• Complete FBR Setup Guide