- How do I install corecave/laravel-zatca in a Laravel application?
- Install it with Composer using composer require corecave/laravel-zatca, then publish the package configuration and set your ZATCA environment, credentials, and certificate paths. The package is Laravel-native, so it exposes config, facades, and Artisan commands for onboarding and submission workflows. Run the package's sandbox flow before pointing it at production endpoints.
- Which Laravel and PHP versions does laravel-zatca support?
- The provided overview does not pin exact Laravel or PHP version constraints, so check the package composer.json before adopting it. Also review the requirements introduced by simplesoftwareio/simple-qrcode if you use the v1.2.0 QR image features. Confirm compatibility with your application's framework and PHP runtime as part of your sandbox spike.
- Does laravel-zatca support ZATCA Phase 2 clearance and reporting?
- The package advertises Phase 1 and Phase 2 workflows, document submission for clearance and reporting, and UBL 2.1 XML generation. Confirm in your own sandbox tests which document types are covered, including standard invoices, simplified invoices, and credit or debit notes. Treat the package as the ZATCA integration adapter, not as your compliance system of record.
- How does the package generate ZATCA QR codes and TLV base64 payloads?
- corecave/laravel-zatca generates base64 TLV QR payloads and, in v1.2.0, adds qr_code_image and qr_code_svg attributes for rendering QR codes. Store the canonical ZATCA-compliant QR payload independently and treat rendered PNG or SVG images as derived artifacts. Verify that the rendered image encodes the same TLV/base64 payload required by ZATCA, not just invoice display data.
- Is simplesoftwareio/simple-qrcode a required dependency, and what PHP extensions are needed?
- v1.2.0 introduces simplesoftwareio/simple-qrcode, but the overview does not confirm whether it is optional. Review composer.json and the package service provider to see whether QR image rendering can be disabled. Image rendering may also depend on GD, Imagick, or other drivers, so test PNG and SVG generation in your target runtime.
- Can I safely use laravel-zatca QR images in PDFs and HTML emails?
- Use the QR image attributes in presentation layers such as emails, PDFs, and receipts, but keep checkout and ERP posting decoupled from rendering. Escape image output in HTML contexts and sanitize or avoid raw SVG in untrusted contexts. Treat generated QR images as derived from the stored ZATCA-compliant QR payload rather than as the source of truth.
- Does laravel-zatca handle CSID onboarding and compliance certificates?
- Yes, the package describes CSID onboarding with compliance and production certificates, plus connectivity to ZATCA sandbox and production endpoints. The documentation clarifications say production CSID does not require OTP and describe the VAT number format, but verify those details against current ZATCA guidance. Keep certificate storage, rotation, and tenant credential isolation under your own security controls.
- How should I store private keys, CSIDs, and ZATCA credentials with this package?
- Use centralized secrets management and encrypted storage rather than committing certificates, private keys, or CSIDs to source control. The package provides Laravel configuration, but your application remains responsible for encryption, rotation, access control, and multi-tenant isolation. If you operate a multi-tenant SaaS, confirm whether the package assumes one company and one credential set or whether you must instantiate it per tenant.
- Does laravel-zatca provide idempotency, retries, queue support, and audit logging for submissions?
- The overview does not document built-in idempotency, retry/backoff, queueing, or audit logging for ZATCA submissions. Because it is Laravel-native, you can wrap it behind an internal ZatcaGateway service and add queued jobs, idempotency keys, and structured logging there. Persist ZATCA requests and responses as compliance artifacts for later audit and reconciliation.
- Is corecave/laravel-zatca production-ready, and what maintenance risks should I consider?
- It is a useful Laravel-native ZATCA integration adapter, but it has a small adoption footprint and limited ecosystem validation in a regulated domain. The highest risk is incorrect ZATCA QR payload generation or cryptographic stamping, not QR image rendering. Before production, run a time-boxed sandbox spike against v1.2.0, review dependency health and license terms for forking, and keep the package behind your own gateway interface.