> ## Documentation Index > Fetch the complete documentation index at: https://docs.newinvoice.dev/llms.txt > Use this file to discover all available pages before exploring further. # Save a SAT credential (CIEC or FIEL) > Save the taxpayer's SAT password (CIEC), or their FIEL (e.firma), for this profile's RFC. Send either `password` or `fiel`. The credential is checked against SAT asynchronously, so a live response starts as `pending`; wait for the `fiscal_profile.sat_credential_verified` webhook or poll GET before relying on it. Saving again replaces and revokes the previous credential. Credentials expire after at most 90 days; a `fiscal_profile.sat_credential_expiring` webhook fires 14 days ahead. Test-mode and sandbox profiles are simulated and verified immediately; nothing leaves this API. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/fiscal_profiles/{id}/sat_credential openapi: 3.1.0 info: title: Invoice API description: >- Mexican CFDI 4.0 invoicing API. Versioned via the Invoice-Version header; current: 2026-07-15. See GET /v1/versions. version: 0.1.0 servers: - url: https://api.newinvoice.dev description: Production - url: http://localhost:3000 description: Local development security: - bearerAuth: [] tags: - name: api_keys description: Platform API-key lifecycle (create, list, revoke) - name: accounts description: 'Connect: platform-owned connected accounts (multi-tenant)' - name: fiscal_profiles description: Emitter RFC + CSD/FIEL registration - name: invoices description: Create, stamp, cancel CFDI 4.0 invoices - name: validations description: Validate arbitrary CFDI XML - name: ticket_invoices description: Self-invoice merchant tickets from a photo (autofacturación) - name: downloads description: SAT descarga masiva jobs - name: fiscal_documents description: SAT documents such as the constancia - name: webhook_endpoints description: HMAC-signed event delivery - name: events description: Event log - name: balance description: Remaining stamp credits - name: usage description: Metered usage records (stamps consumed) - name: catalogs description: SAT reference catalogs (uso CFDI, payment forms/methods, tax regimes, …) - name: docs description: Served documentation (error catalog + guides) paths: /v1/fiscal_profiles/{id}/sat_credential: post: tags: - fiscal_profiles summary: Save a SAT credential (CIEC or FIEL) description: >- Save the taxpayer's SAT password (CIEC), or their FIEL (e.firma), for this profile's RFC. Send either `password` or `fiel`. The credential is checked against SAT asynchronously, so a live response starts as `pending`; wait for the `fiscal_profile.sat_credential_verified` webhook or poll GET before relying on it. Saving again replaces and revokes the previous credential. Credentials expire after at most 90 days; a `fiscal_profile.sat_credential_expiring` webhook fires 14 days ahead. Test-mode and sandbox profiles are simulated and verified immediately; nothing leaves this API. parameters: - schema: type: string in: path name: id required: true description: The fiscal profile id, e.g. "fp_01H...". - $ref: '#/components/parameters/InvoiceVersion' - $ref: '#/components/parameters/InvoiceAccount' - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: anyOf: - type: object properties: password: type: string minLength: 1 maxLength: 256 description: >- The taxpayer's SAT password (CIEC / contraseña) for the profile's RFC. Used once to save the credential and never stored by this API, in any form. required: - password additionalProperties: false - type: object properties: fiel: type: object properties: cer_base64: type: string minLength: 1 description: >- Base64 of the certificate (.cer) exactly as issued by the SAT (DER). Tip: skip base64 entirely — upload the raw file via multipart/form-data (e.g. `csd_cer`) instead. key_base64: type: string minLength: 1 description: >- Base64 of the private key (.key, DER-encoded encrypted PKCS#8) as issued by the SAT. Tip: upload the raw file via multipart/form-data (e.g. `csd_key`) to skip base64. password: type: string minLength: 1 description: >- The private-key password ("contraseña de la clave privada"). required: - cer_base64 - key_base64 - password description: >- The taxpayer's FIEL (e.firma), instead of the password: certificate, private key and private-key password for the profile's RFC. Used once to save the credential and never stored by this API, in any form. required: - fiel additionalProperties: false example: password: string responses: '201': description: Default Response content: application/json: schema: type: object properties: object: type: string description: Always "sat_credential". enum: - sat_credential fiscal_profile_id: type: string description: The fiscal profile this credential belongs to. rfc: type: string description: The RFC the credential authenticates. status: type: string enum: - pending - verified - rejected - inconclusive - expired description: >- pending: the SAT login check is running. verified: SAT accepted the password at the time of the check. rejected: SAT explicitly refused it. inconclusive: the check could not tell (for example an outage or a CAPTCHA problem). expired: the saved credential has passed `expires_at`. expires_at: anyOf: - type: string - type: 'null' description: When the saved credential expires, ISO-8601 UTC. remediation: anyOf: - type: string - type: 'null' description: >- What to do next when status is rejected, inconclusive or expired; null otherwise. Written for humans and agents. livemode: type: boolean description: False for test-mode (simulated) credentials. required: - object - fiscal_profile_id - rfc - status - expires_at - remediation - livemode additionalProperties: false example: object: sat_credential fiscal_profile_id: fp_2P9K3sample rfc: XAXX010101000 status: pending expires_at: '2026-07-10T18:25:43Z' remediation: string livemode: false headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' '401': description: Missing or invalid API key. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/auth_unauthorized title: Authentication required status: 401 code: auth.unauthorized detail: Missing or invalid API key. remediation: >- Send `Authorization: Bearer sk_test_...` (or sk_live_...) with a valid API key. doc_url: /docs/errors#auth-unauthorized request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' '404': description: Resource not found in this org + mode. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/resource_not_found title: Resource not found status: 404 code: resource.not_found detail: No such id in this org + mode. remediation: >- Verify the id and that the key mode (test/live) matches the id. doc_url: /docs/errors#resource-not_found request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' '409': description: Conflict (e.g. idempotency/state). content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/fiscal_profile_in_use title: Fiscal profile is in use status: 409 code: fiscal_profile.in_use detail: The profile is referenced by issued invoices. remediation: >- Profiles with invoices are retained; rotate the CSD instead of deleting. doc_url: /docs/errors#fiscal_profile-in_use request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' '422': description: Request validation failed. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/fiscal_profile_invalid_csd title: Invalid CSD certificate or password status: 422 code: fiscal_profile.invalid_csd detail: The CSD .cer/.key pair could not be opened. remediation: >- Verify cer_base64 is the .cer, key_base64 is the .key, and the password. doc_url: /docs/errors#fiscal_profile-invalid_csd request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' '429': description: Rate limit exceeded — back off per the Retry-After header. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/rate_limit_exceeded title: Rate limit exceeded status: 429 code: rate_limit.exceeded detail: >- Too many requests for this key + request class (reads and writes are limited separately). remediation: >- Back off and retry after the number of seconds in the Retry-After header; batch work or lower your request rate. doc_url: /docs/errors#rate_limit-exceeded request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' Retry-After: $ref: '#/components/headers/RetryAfter' '500': description: Internal server error. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' example: type: https://errors.invoiceapi.mx/internal_error title: Internal server error status: 500 code: internal.error detail: An unexpected error occurred. remediation: >- Retry later; contact support with the request_id if it persists. doc_url: /docs/errors#internal-error request_id: req_2P9K3sample headers: Request-Id: $ref: '#/components/headers/RequestId' Invoice-Version: $ref: '#/components/headers/InvoiceVersionResponse' traceparent: $ref: '#/components/headers/Traceparent' components: parameters: InvoiceVersion: name: Invoice-Version in: header required: false description: >- Pin a dated API release (Stripe-style). Omit to use the current version. An unknown value returns 400 `request.invalid_version`. Echoed back on every response. schema: type: string example: '2026-07-10' InvoiceAccount: name: Invoice-Account in: header required: false description: >- Connect: act on behalf of one of your connected accounts (its `acct_…`/`org_…` id). Omit to act as your own organization. Not honored on /v1/api_keys. schema: type: string example: org_2P9connectedacct IdempotencyKey: name: Idempotency-Key in: header required: false description: >- Safely retry any POST. A successful (2xx) response is stored for 24h and replayed byte-for-byte for identical retries (the replay adds an `idempotent-replayed: true` header). A non-2xx releases the key, so you can fix the cause and retry with the same key; `pac.stamp_outcome_unknown`, `pac.auth_failed` and `download.request_failed` are the exceptions and replay like a success. Reusing the key of a stored response with a different body is 409 `idempotency.key_reuse`; an in-flight duplicate is 409 `idempotency.key_processing`. schema: type: string example: a1b2c3d4-e5f6-4789-8abc-1234567890ab headers: RequestId: description: >- Unique id for this request. Also the `request_id` in every error body — log it and quote it to support; idempotency keys off it too. schema: type: string example: req_2P9K3sample InvoiceVersionResponse: description: >- The dated API version resolved for this request (request header → key pin → current). Echoed on every response. schema: type: string example: '2026-07-15' Traceparent: description: >- W3C Trace Context. When you send a valid `traceparent`, the response continues the trace (same trace-id, a fresh span-id, sampled flag). schema: type: string example: 00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01 RateLimitLimit: description: >- IETF draft rate-limit: the ceiling of the token bucket consulted for this request class (reads and writes have independent buckets). schema: type: integer example: 100 RateLimitRemaining: description: 'IETF draft rate-limit: tokens left in the bucket after this request.' schema: type: integer example: 99 RateLimitReset: description: 'IETF draft rate-limit: seconds until the bucket refills to its ceiling.' schema: type: integer example: 1 RetryAfter: description: >- Seconds to wait before retrying (RFC 9110). Present on 429 and on retryable upstream failures. schema: type: integer example: 1 schemas: Problem: type: object description: RFC 9457 problem+json error with agent-first extensions. properties: type: type: string format: uri title: type: string status: type: integer code: type: string description: Stable dotted machine code to switch on. detail: type: string remediation: type: string description: Actionable next step for a human or agent. request_id: type: string pac: type: object properties: provider: type: string codigo: type: string mensaje: type: string errors: type: array items: type: object properties: field: type: string message: type: string required: - type - title - status - code - request_id securitySchemes: bearerAuth: type: http scheme: bearer description: 'API key: `Authorization: Bearer sk_test_...` or `sk_live_...`.' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.