Live on AEAT production · v0.3

Sign, chain,
send.

A multi-tenant electronic invoicing gateway for apps that file with AEAT, SII and TicketBAI through a single API. You POST the invoice; we sign XAdES, chain hashes and speak SOAP to the Spanish tax office.

Start free Read the API

Pago Redsys 3DSv2 Sin permanencia Primera factura gratis

One call

This is all your app needs to run.

The SHA-256 hash is chained per emitter NIF with a row-level lock — two concurrent POSTs produce distinct, consistent chain_index values.

POST /api/v1/invoices

curl -X POST https://api-verifactu.c2developers.com/api/v1/invoices \
  -H "Authorization: Bearer vf_live_a1b2c3d4e5f6g7h8" \
  -H "X-Verifactu-Emisor: B12345678" \
  -H "Content-Type: application/json" \
  -d '{
    "serie": "A", "numero": "00042",
    "fecha_expedicion": "19-05-2026",
    "tipo_factura": "F1",
    "nif": "A15022510",
    "nombre": "Acme S.L.",
    "lineas": [{
      "base_imponible": "1000.00",
      "tipo_impositivo": "21.00",
      "cuota_repercutida": "210.00"
    }],
    "importe_total": "1210.00"
  }'

201 Created

pending → accepted

{
  "id": "a78e1146-4d64-42c4-b667-8a1177e41ff2",
  "huella": "DC7F8C475732C3342370A7E64E93EC46529DB98F216F9BD2FFDD18BDDD36249D",
  "chain_index": 1,
  "qr_url": "https://www2.aeat.es/wlpl/TIKE-CONT/ValidarQR?...",
  "aeat_status": "pending"
}

How it works

Three steps. We handle the rest.

Designed so your integration ships to production this week.

POST the invoice as JSON

One request with the invoice fields. No certificates to look after. No XML to fight with. Unlimited sandbox calls.

Get the QR back instantly

Your app receives the Verifactu QR right in the response. Paste it on the invoice and print or send. AEAT validates it the same.

And we handle the rest

XAdES-BES signed XML, chained hash, mutual-TLS SOAP, retries when AEAT asks for backoff, HMAC-signed callback when a response lands.

RD 1007/2023

These are the deadlines.

Verifactu is mandatory. Not optional, not endlessly postponed, not "I will get to it when there is an SDK". Royal Decree-Law 15/2025 pushed back taxpayers — it did not push back developers.

1 July 2025
Invoicing software providers (SIF)
Software vendors are already on the hook. Your product needs to be adapted.
1 January 2027
Companies under Corporate Tax
Limited companies start live reporting.
1 July 2027
Everyone else
Sole traders and similar. The last train leaves here.

What we do for you

A complete Verifactu (and TicketBAI) toolkit.

Easy, robust, affordable. Everything you would expect from a premium pricing tier — without the surprise on the invoice.

Save development time

Forget XMLs, chained hashes and certificates. Send us clean JSON and skip weeks of work. Clear docs, autogenerated TypeScript SDK, examples per stack.

Stay technically compliant

We keep the integration aligned with AEAT. When they publish a new XSD version we absorb it — nothing changes on your end.

No client certificates needed

IZ860 power-of-attorney model: your client signs a power in sede.aeat.es in our favour. You never have to look after a third-party .p12.

Responsibility declaration ready

We give you a template suited to a mixed architecture and tell you exactly where and how to publish it. No audits, no homologation.

Send log and XML download

We keep every signed XML for 4 years (the statutory period). Download them from the panel or API whenever an inspector asks.

Full web panel

Invoice list, detail with AEAT status and CSV per submission, bulk CSV/XLSX upload, OCR of old PDFs, emitter NIF management.

Errors caught before sending

We validate against the official XSD and business rules before touching AEAT. If anything fails we reply 400 with field and reason. Fewer corrections downstream.

Scalable infrastructure

Postgres + asynchronous workers. Each invoice processed in its own context. If your volume hits the millions we do not need to rewrite a thing.

HMAC webhooks with retry

When AEAT replies we call your URL with HMAC-SHA256 signature. Automatic retries at 60s · 5m · 30m · 2h · 12h. Nothing slips through.

Integration

An API built by people who also integrate APIs.

Designed so you can plug in your ERP, POS or mobile app in an afternoon. No SOAP, no certificates, no reinventing the wheel.

Start free API docs

OpenAPI 3 documentation
Full spec with Swagger UI. Importable to Postman, Insomnia, etc.
Autogenerated TypeScript SDK
Typed client in @verifactu/sdk. Works in Node, Bun, Deno and the browser.
Free account with test NIF
Unlimited calls against AEAT sandbox before you pay a cent.
Real human support by email
We respond in under 24h. No bots, no seven-tier escalation.

Built for builders

Works the same for both sides of the counter.

One solution, two profiles.

You build software

Adapt and certify your management software with minimal effort to comply with Spain's anti-fraud law.

ERP vendor
ERP integrator
Invoicing software
POS software
PMS (hospitality)
Mobile app developer
Tech consultancy
SaaS resellers

You adapt your own software

If you have an in-house system and you need it Verifactu-compliant, our API is the right fit — whether you are a small business or a group.

In-house invoicing tools
Stripe or other gateways
Shopify / WooCommerce adaptation
In-house ERP refresh
Legacy migrations
Multi-tenant for groups

Coverage

All of Spain’s tax regimes behind a single API.

Each emitter picks its regime when it is created. The resolver routes to the right gateway — your app never has to know there are seven separate systems.

Regime	Specification	Status	Notes
AEAT national	RD 1007/2023 · Verifactu	Live	XAdES-BES, hash chain, SOAP, AEAT QR validator
SII national	AEAT · REDEME / large filers	Live	Immediate information supply
SII Navarra	siihacienda.navarra.es	Live	Hacienda Foral de Navarra · live
TicketBAI Bizkaia	Bizkaia provincial council	Live	Live since 2022
TicketBAI Gipuzkoa	Gipuzkoa provincial council	Live	Live since 2022
TicketBAI Álava	Foral Provincial Council of Álava	Live	Live since 2022
NaTicket Navarra	Hacienda Foral de Navarra	Spec pending	No spec published · stub in place

We say out loud what does not work yet. When NaTicket publishes its spec we will turn it on without you changing a line.

An opinion we stand by

We don't ask for your client's certificate.

Asking each client for their .p12 is an operational and legal nightmare: they expire every two years, you have to rotate them, keep them, encrypt them at rest. AEAT has had a better mechanism for years and almost nobody uses it: the IZ860 electronic power of attorney.

Your client signs a power in your favour (through us) at sede.aeat.es. From that moment we can send their invoices with our certificate, in their name. If they revoke it stops working immediately. If AEAT replies with code 4112 we auto-revoke it in our database.

Old vs. new

Asking each client for the .p12

Custody of N third-party certificates. Two-year rotation. Encryption at rest. Continuous audit.

IZ860 power of attorney

The client signs in sede.aeat.es. You sign with your SIF cert. If they revoke or it fails, we detect it on the first real send.

Current attorney-in-fact: J71554372 · C2Developers S.I. · Own SIF cert available on request for SaaS resellers.

Historic onboarding

Upload the PDF. We return the JSON.

When a client arrives with 800 old PDFs no one types them again. POST /v1/invoices/import-pdf sends the document to Claude Vision, returns normalised Verifacti-style fields and pre-fills the portal form.

We don't auto-submit. A human reviews before clicking. For 800 invoices, 30 seconds per review beats 10 minutes of re-typing.

PDFnative application/pdf · no pre-OCR · 10 MB max
JPGphone photo works too · image/jpeg, png, webp
JSONseries, number, date, VAT grouped by rate, total

curl · 10 MB · multipart

curl -X POST .../invoices/import-pdf \
  -H "Authorization: Bearer vf_live_..." \
  -F "[email protected]"

200 OK · extracted

{
  "serie": "A", "numero": "00031",
  "fecha_expedicion": "15-11-2024",
  "tipo_factura": "F1",
  "nombre": "Maderas del Norte S.L.",
  "lineas": [
    { "base_imponible": "4150.00", "tipo_impositivo": "21.00", "cuota_repercutida": "871.50" },
    { "base_imponible": "150.00",  "tipo_impositivo": "4.00",  "cuota_repercutida":   "6.00" }
  ],
  "importe_total": "5177.50"
}

Pricing

Pick a plan that matches your size.

No setup fees. No lock-in. Cancel any time. Pay only for active emitters.

Sandbox

€0/ always

Try the integration before committing. No card required.

1 free real invoice
Unlimited AEAT sandbox calls
Full portal and API access
OCR included
Signed HMAC webhooks

Start free

★ Recomendado

Operativo

from

€1.99per NIF / month

For sole traders, SMBs and developers with one or several emitters.

Number of emitter NIFs

1 NIFs

9,99 € / NIF1 × 9,99 €

Total / month9,99 €/ mes

3,000 invoices per NIF/month
Managed IZ860 power of attorney
Built-in payment gateway (Redsys)
Email support · reply under 24h

Configure my plan

Plataforma

Custom

For SaaS resellers and ERPs with hundreds or thousands of emitters.

No volume cap · usage pricing
Use your own SIF cert if you prefer
Committed-response SLA
Assisted onboarding and migration

Talk to sales

Excludes VAT · 3,000 invoices per NIF/month included · €2 per extra 1,000

Questions

What almost everyone asks.

What is Verifactu and why do I need a solution?

Verifactu is the mandatory reporting of invoice records to the Spanish tax office (Royal Decree 1007/2023). Businesses with invoicing software must transmit each issued invoice immediately, signed XAdES with a chain of hashes. Doing it by hand is months of XML, SOAP, XSD and certificates. We do it for you.

Why don't you ask for the client's digital certificate?

Because the IZ860 power of attorney avoids it: your client signs an electronic power in sede.aeat.es in favour of C2Developers (NIF J71554372) and from that moment we can send their invoices on their behalf with our own certificate. Their cert never leaves their hands and they can revoke it any time.

Do you have a free tier?

Yes. Register, sign the IZ860 power and you can issue 1 free real invoice. For the second one you activate a subscription at from €1.99 per NIF/month (volume discount applies). Sandbox calls are always unlimited and free.

How does the old-PDF OCR work?

In the portal, when you create a new invoice, you can upload a PDF or photo of an existing one. The system uses Claude (Anthropic) to extract the fiscal fields — series, number, amounts, VAT rates, recipient — and fills the form for you. You review, adjust if needed and submit. Perfect for clients arriving with a back catalogue.

Which regimes do you support?

AEAT Verifactu national (RD 1007/2023), SII national (REDEME / large filers), SII Navarra, TicketBAI Bizkaia/Gipuzkoa/Álava. NaTicket Navarra when its specification is published.

How do you tell me about each invoice?

A signed webhook: as soon as AEAT replies we call your URL with POST and a header X-Verifactu-Signature: t=<unix>,v1=<sha256>. You validate the HMAC with your webhook_secret. Automatic retries at 60s, 5m, 30m, 2h and 12h on failure.

What if AEAT rejects one of my invoices?

The panel shows the exact code and description (4112, 4105, 1100, etc.). If it is a power-of-attorney error (4112) we auto-revoke the confirmation in the portal so you re-sign. If it is a data error, you fix and resubmit from the detail.

Who are you?

C2Developers S.I., a software company incorporated in Pamplona, Navarra. NIF J71554372. We have spent years building B2B SaaS for Spanish SMBs and sole traders. Verifactu is our bet so no client of ours has to fight Hacienda ever again.

Five minutes for
the account. Two for
the power of attorney.

After that, your next invoice already travels to AEAT with a valid QR. If you change your mind within a week, delete the account. No card, no calls.

Create account Talk to a human

Sign, chain,send.