Signed QR Code in e-Invoicing System

In the e-Invoicing system, after requesting an IRN (Invoice Reference Number) from the IRP (Invoice Registration Portal), the IRP generates a unique QR code known as the ‘Signed QR Code’. This QR code contains the hashed IRN (Invoice Reference Number) along with other essential parameters of the invoice and a digital signature.

The ‘Signed QR Code’ is included in the response provided by the IRP to the taxpayer who requested the IRN for their invoice. This QR code serves as a verification mechanism for taxpayers and tax officers to validate whether the e-invoice has been reported to the IRP and accepted by it.

By scanning the QR code using an Offline App, taxpayers and tax officers can easily verify the authenticity of the e-invoice. The presence of the IRN and the digital signature of the IRP within the signed QR code serve as proof that the e-invoice has been received and registered by the IRP.

It’s important to note that if the signed JSON (data in the e-invoice) is tampered with, the e-invoice becomes invalid, and the digital signature will fail, indicating that the e-invoice has been altered or tampered with. This ensures the integrity and security of the e-invoice system.

The QR code generated in the e-Invoicing system contains the following e-invoice parameters:

1. GSTIN of the Supplier
2. GSTIN of the Recipient
3. Invoice number assigned by the Supplier
4. Date of invoice generation
5. Invoice value, including taxable value and gross tax amount
6. Number of line items in the invoice
7. HSN (Harmonized System of Nomenclature) code of the main item, which refers to the line item with the highest taxable value
8. Unique Invoice Reference Number (IRN) in hashed form
9. Date of IRN generation

The ‘Signed QR Code’, provided in Base64 format, can be used by the taxpayer to generate the QR code on the invoice copy. The QR code should be an integral part of the invoice and must be readable by QR code readers or apps. The size and placement of the QR code on the invoice can be determined according to the preference of the businesses.

To verify the authenticity of the e-invoice, anyone can use the offline app provided on the IRP portal. By scanning the QR code using the app, the information encoded in the QR code, including the signed parameters and the IRN, can be verified. This allows users to validate the e-invoice and ensure its integrity.

The Signed QR code, when it is printed will look like as follows

The IRP provides the Signed QR Code for the IRN request in a Base64 encoded format, structured as a JSON Web Token (JWT). The JWT consists of three parts: the signature parameters, the data, and the signature itself. These parts are separated by dots. In the example provided, the parts are indicated in red color.

"SignedQRCode":"eyJhbGciOiJSUzI1NiIsImtpZCI6IjExNUY0NDI2NjE3QTc5MzhCRTFCQ
TA2REJFRTkxQTQyNzU4NEVEQUIiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJFVjlFSm1GNmVUaS1
HNkJ0dnVrYVFuV0U3YXMifQ.eyJkYXRhIjoie1wiU2VsbGVyR3N0aW5cIjpcIjM3QlpOUE
05NDMwTTFLTFwiLFwiQnV5ZXJHc3RpblwiOlwiMDNCWk5QTTk0MzBNMUtMXCIsXCJ
Eb2NOb1wiOlwiUVdFMS00NTQ1NjVcIixcIkRvY1R5cFwiOlwiSU5WXCIsXCJEb2NEdFwi
OlwiMDUvMDkvMjAyMFwiLFwiVG90SW52VmFsXCI6MTY2NTUuOTksXCJJdGVtQ250
XCI6MSxcIk1haW5Ic25Db2RlXCI6XCIzOTIzMTAxMFwiLFwiSXJuXCI6XCIzMDFhNzIyZW
MxZGQxNWM5YjQ1YzRkZmViNTZiOTU5YjcyM2E3ZjI1NTdmNDkzM2RmOWFkNmUw
YWEzNGMyZTA4XCIsXCJJcm5EdFwiOlwiMjAyMC0wOS0xMCAxMjozMzowMFwifSIsI
mlzcyI6Ik5JQyJ9.bMApyZTeOo1Aixelld8EsTA57h4gNBYMemN--
Onpr_Smr2pn3BUBwfyL_kyIGea5cfQT40qPCUc81drnIHlQpVSVIyhiUMU0NnxMWx2jJ
g0cS8CuaYdvHOzB1gYYYdeRI6B5RroFi8zxKVbL9HCyJVFalXhDOgWb5IgI9BhWDej1HA
s3GerNTtYztoMg7qyFZql3mwqcL7IRtjCwsVVYYeFT9uvKdM9tSorIkQTdWPvMpFHScittzM
QyNYW9YY5UPkZxt_rftAgYv-ELXyMcZC_qLdO8EASPH-jL-wpEV711N5zdtQ6kWsKfcJiHOVmMCaoRginV_kBVWsJNN7wg”

On decoding Signed QR Code parameter, it looks like as follows

{
 "alg": "RS256",
 "kid": "115F4426617A7938BE1BA06DBEE91A427584EDAB",
 "typ": "JWT",
 "x5t": "EV9EJmF6eTi-G6BtvukaQnWE7as"
}
{
"data":
"{\"SellerGstin\":\"37BZNPM9430M1KL\",\"BuyerGstin\":\"03BZNPM9430M1KL\",\"
DocNo\":\"QWE1-
454565\",\"DocTyp\":\"INV\",\"DocDt\":\"05/09/2020\",\"TotInvVal\":16655.99,\"It
emCnt\":1,\"MainHsnCode\":\"39231010\",\"Irn\":\"301a722ec1dd15c9b45c4dfeb5
6b959b723a7f2557f4933df9ad6e0aa34c2e08\",\"IrnDt\":\"2020-09-10 12:33:00\"}",
 "iss": "NIC"
}

To verify the signature of the Signed QR Code, one can utilize the corresponding DS Certificate obtained from the portal. The Public Key required for verification is provided below. By using the Public Key and the provided data, the authenticity and integrity of the Signed QR Code can be confirmed.

"PublicKey":
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArxd93uLDs8HTPqcSPpxZrf0
Dc29r3iPp0a8filjAyeX4RAH6lWm9qFt26CcE8ESYtmo1sVtswvs7VH4Bjg/FDlRpd+MnAlX
uxChij8/vjyAwE71ucMrmZhxM8rOSfPML8fniZ8trr3I4R2o4xWh6no/xTUtZ02/yUEXbphw3
DEuefzHEQnEF+quGji9pvGnPO6Krmnri9H4WPY0ysPQQQd82bUZCk9XdhSZcW/am8w
BulYokITRMVHlbRXqu1pOFmQMO5oSpyZU3pXbsx+OxIOc4EDX0WMa9aH4+snt18WA
XVGwF2B4fmBk7AtmkFzrTmbpmyVqA3KO2IjzMZPw0hQIDAQAB"