FBR Sandbox vs Production Tokens: How They Work in Taxora.pk

FBR’s Digital Invoicing API (on PRAL’s platform) is locked with a security token. The same validate and post URLs are used for practice and for live invoices - the token decides which world you are in. This guide follows FBR DI API technical documentation V1.12 and the DI user manual, then shows how Taxora.pk uses those tokens day to day.

Try sandbox vs production

Toggle the interactive panel to see which Taxora workflows each token unlocks. Sandbox = scenario practice. Production = validate/post for real invoices.

Authorization: Bearer <sandbox-token>

What the FBR docs say (short version)

• The Web API sits on PRAL ESP and exposes Digital Invoicing methods including Validate and Post (DI API V1.12).
• Every request needs a security token in the header: Authorization: Bearer <token>.
• PRAL issues the token with the API URLs. Documented validity is up to five years; request a new one before expiry.
• Sandbox and production use the same URL pattern; routing follows which token you send. Sample JSON differs between sandbox and production sections in the PDF - do not mix them.

Always prefer the live PDF over summaries: DI API V1.12 and DI User Manual V1.5.

Sandbox token - practice safely

1. Finish IRIS Digital Invoicing registration and choose PRAL (or another licensed integrator).
2. Whitelist the public IPs of the servers that will call the API (Taxora’s team helps with cloud IPs).
3. Open the Sandbox Environment tab in the FBR/PRAL flow and copy the sandbox security token.
4. Paste it into Taxora under Integration → FBR sandbox credentials (never commit tokens to chat logs or git).
5. Run the assigned sandbox scenarios (buyer types, rates, debit/credit notes, etc.). Taxora’s scenario tools mirror those cases so you can practise with fake data before production.

Sandbox invoices are not live tax invoices. They exist to prove your mapping works before production. More on scenarios: sandbox scenarios explained.

Production token - live invoices

1. Only after sandbox scenarios succeed, request production credentials from the same FBR/PRAL path.
2. Store the production token only in Taxora’s Integration → FBR production credential fields.
3. Create a real invoice, then validate and post. On success, keep the FBR invoice number and QR PDF.
4. Treat production like cash: rotate access if staff leave; never reuse sandbox sample JSON in production.

How Taxora uses the token

When you click validate or post on a real invoice, Taxora builds the invoice object, attaches Authorization: Bearer … with your production token, and calls PRAL. Sandbox tokens stay reserved for scenario practice. Errors come back as human-readable messages where possible (HS, UOM, buyer, rate). Success stores the invoice number and QR for the PDF. Full day-to-day loop: how Taxora FBR invoicing works.

IP whitelist and tokens work together

A perfect token still fails if the call leaves from an IP that is not whitelisted. Whitelist first, then test the sandbox token, then production. Guide: sandbox and IP whitelisting.

Common mistakes

• Using the sandbox token after switching Taxora to “live”
• Copying production sample JSON into sandbox (or the reverse)
• Skipping scenarios and asking for production early
• Sharing Bearer tokens in WhatsApp screenshots
• Forgetting to renew before the five-year expiry window

Quick FAQ

Who issues the token? PRAL issues it as part of Digital Invoicing integration after IRIS steps - not Taxora.

Can one token do both sandbox and production? No. Use the sandbox token for practice and the production token for live invoices.

Is Taxora affiliated with FBR or PRAL? No. Independent software that calls the API with the credentials you registered.