Fiskalizacija HR for WooCommerce — fiscal receipts to the Croatian Tax Administration CIS (ZKI, JIR, QR)

Fiskalizacija HR for WooCommerce is a plugin for online shops in Croatia that sell on WooCommerce. In Croatia every receipt to an end customer must be fiscalised whatever the payment method — since 1 January 2026 that includes payments to the transaction account. The shop computes the ZKI protective code, sends the signed receipt to the Tax Administration (Porezna uprava) fiscalisation service CIS and prints the receipt identifier JIR and a QR code on the receipt. The plugin does this for WooCommerce orders directly against CIS with your own application certificate — no third-party invoicing service in between and no monthly subscription.

Running OpenCart? There is a separate version for it — Fiskalizacija HR for OpenCart (4.x, 3.x and 2.3), with the same signature, ZKI and request format; the OpenCart licence is a one-time payment, forever.

What you need. The OIB of your company or craft; the web shop registered as business premises in ePorezna (the plugin does not do that — it only needs the premises label, for example WEB1); an application certificate for fiscalisation issued to your OIB by a trusted provider such as FINA. The CIS test environment accepts only DEMO certificates, production only production ones. Shop currency: EUR.

Honestly about testing. The plugin was checked against the official CIS technical specification “Tehnička specifikacija za korisnike” v2.7 and FiskalizacijaSchema / WSDL 1.10: every generated request — ordinary receipts, late delivery, storno with negative amounts, receipts with the buyer OIB — passed the official XSD and an independent signature check, and every ZKI was recomputed separately. The full run was on a local WooCommerce shop (PHP 7.4 and 8.3, HPOS on and off, classic and block checkout) with a model of CIS answers: success, refusals s001–s006 and s013, outages, broken answers. The real CIS test server answered us only without a DEMO certificate: getting one needs a Croatian OIB, which CatCode does not have. So you get a live JIR in your own 7-day Pro trial with a FINA DEMO certificate — the Tax Administration recommends at least two days of stable work in the test environment before going to production anyway. If CIS answers differently from the specification, we will fix it promptly.

Responsibility for the receipt data stays with the shop. The plugin takes amounts and taxes from the WooCommerce order, and the VAT system, premises and device labels, operator, payment methods and the category for untaxed lines from your settings. Go through these settings with your accountant before switching to production.

What the buyer sees

After payment the thank-you page shows the “Fiskalizirani račun” block: the receipt number in number/premises/device format, date and time, payment method, operator, ZKI, JIR and a QR code linking to the receipt check on porezna.gov.hr. The same block is in “My account” on the customer’s order.

Fiscal data and the QR code also go into WooCommerce customer e-mails — Processing, Completed, invoice, refund. The QR code in the e-mail is a PNG image. The block on the page and in e-mails can be switched off separately.

Pro. The classic and block checkout get an “OIB tvrtke (za B2B račun)” field — for companies paying by card or cash that want their OIB on the receipt. The plugin validates the OIB check digit: a wrong number blocks the order, with an explanation in Croatian. The field can be hidden, optional, or required for B2B shops.

What the admin gets

• WooCommerce → Fiskalizacija with the “Receipts”, “Settings” and “Licence” tabs (Računi, Postavke, Licenca in the Croatian admin).
• Receipt register: number and date, order, amount, payment method, status (“Fiskaliziran (JIR)”, waiting, refused), ZKI and JIR, the CIS error text; filter by status and search by number or order.
• “Deliver waiting receipts now” sends the queue at once without waiting for cron, and “Send all refused receipts again” or “Send again” on a single receipt re-sends refused receipts after you fix the settings.
• The top of the page shows the environment (TEST or PRODUCTION) and a notice when CIS refused receipts.

The receipt page shows everything that went to CIS and came back: environment, status, ZKI, JIR, whether the answer signature was verified, attempts, the last message id, and below that the last XML request and answer. In the test environment there is a “Check at CIS test” button — the provjera method, with which CIS checks a receipt without fiscalising it.

Every order has a “Fiskalizacija” box with number, amount, status, ZKI, JIR and the QR code, and order notes record each step: receipt issued, fiscalised, waiting, refused.

How it works — step by step

1. Business premises. You register the web shop in ePorezna and note its label (for example WEB1) — the plugin needs exactly the same label.
2. Settings. Issuer OIB, whether you are in the VAT system, premises label, device number, numbering sequence (per premises or per device), restart on 1 January, operator, the order status that issues the receipt, and the last used number if you continue a sequence from other software.
3. Certificate. Upload the .p12 with its password — DEMO for test, production for production. The plugin shows the certificate owner and validity, warns if its OIB differs from the issuer OIB (CIS would refuse such receipts with s005), and keeps the private key encrypted. “Check connection to CIS” tests the link with the echo method.
4. Order. When an order becomes Processing or Completed (your choice), the plugin checks amounts and rates locally, only then takes the next number, computes the ZKI, builds and signs the RacunZahtjev and sends it to CIS.
5. Answer. CIS returns the JIR — the plugin verifies the answer signature, stores the JIR on the order and shows the receipt to the customer. Error s001–s005 or s013 — the receipt is “refused”, the reason is in the register, “Send again” after a fix.
6. Connection failure. CIS did not answer within a few seconds (8 by default) — the receipt is already valid with its ZKI and the customer sees it; the plugin delivers it later marked NakDost with a new message id, with growing pauses between attempts.

VAT comes from each order’s tax lines, grouped by rate — 25 %, 13 %, 5 % or 0 %. A rate CIS does not accept (for example 19 %) is stopped before sending, and no number is used up. Untaxed lines go as VAT exempt, not taxable or 0 % — as you choose; fees named like “povratna naknada” go as Naknade. Rounding cents between the lines and the order total are settled so the receipt total matches to the cent. The payment method is set per gateway: G cash, K card, T transaction account, O other.

Pro. A WooCommerce refund — full, partial by line or amount-only — produces a storno receipt with negative amounts at the same VAT rates; each further amount-only refund is calculated from what is left after earlier storno receipts. Fiscal data and the QR code (25×25 mm) are added to PDF Invoices & Packing Slips documents. The register exports to CSV (UTF-8 with BOM, “;” separator, decimal comma), and alerts go to the address you set when CIS refuses a receipt or is unreachable.

Under the hood

• CIS: RacunZahtjev (fiscalisation), ProvjeraZahtjev (check, test only), echo (connection); endpoints cistest.apis-it.hr:8449 and cis.porezna-uprava.hr:8449.
• ZKI — MD5 of the RSA-SHA256 signature of OIB + date and time + number + premises + device + amount, as in chapter 12 of specification v2.7.
• Request signature — enveloped XMLDSig: Exclusive C14N, RSA-SHA256, SHA-256 digest. RSA-SHA1 is not used: the CIS test service refuses it since 1 July 2026, production from 1 January 2027.
• TLS and the answer: the connection is verified against bundled FINA certificates (Fina RDC 2020, Fina Demo CA 2020), the answer signature against the fiskalcis certificate. When the CA changes, the certificates are updated with a new version or the ccfh_ca_file filter.
• Locked numbering: parallel orders never get the same number or leave gaps; separate counters for test and production.
• Queue — WooCommerce Action Scheduler (or WP-Cron) with growing pauses; receipts older than 30 days are not sent (CIS refuses them).
• Certificate: the private key is stored in the database encrypted with AES-256 under a key derived from the site salts, or as a file outside the web root via CCFH_CERT_FILE and CCFH_CERT_PASSWORD in wp-config.php.
• CIS model: the CCFH_CIS_MOCK constant (ok, down, s002, s004, s006, s013) simulates answers in the test environment only — to try the shop before you have a certificate.
• Deleting the plugin removes certificates and cron jobs; the register, counters and settings stay as tax records. The CCFH_DELETE_DATA constant removes those too.

Installation

1. Plugins → Add New → Upload Plugin: choose catcode-fiskalizacija-hr-for-woocommerce-1.0.0.zip and activate it (WooCommerce must be active).
2. Register the web shop as business premises in ePorezna and note its label.
3. WooCommerce → Fiskalizacija → Settings: issuer OIB, VAT system, premises label, device number, operator, payment methods.
4. Upload the DEMO .p12 certificate with its password and press “Check connection to CIS”.
5. Place test orders and check the receipts in the register and with “Check at CIS test”.
6. Show the settings to your accountant, switch the environment to Production and upload the production certificate.
7. For Pro: paste the licence key from the e-mail after payment, or start the 7-day trial in the “Licence” tab.