GST e-Invoice QR Code Mechanics: B2B IRN Verification & NIC Portal Guide

1. The GST e-Invoicing Legal Mandate: Turnover Thresholds

Under Rule 48(4) of the Central Goods and Services Tax (CGST) Rules, 2017, the Government of India made electronic invoicing (e-invoicing) mandatory for all registered businesses exceeding specific aggregate annual turnover thresholds. Beginning initially with enterprises over ₹500 Crore, the mandate has progressively expanded to include all taxpayers with turnover exceeding ₹5 Crore.

The primary statutory objective is eradicating the fake invoice menace, automating Input Tax Credit (ITC) reconciliation in GSTR-2B, and integrating highway transit tracking with the national E-Way Bill system.

2. 64-Character IRN Architecture: SHA-256 Hashing Mechanics

The core digital anchor of an e-invoice is the Invoice Reference Number (IRN). Rather than an arbitrary serial number, the IRN is a deterministic 64-character hexadecimal string generated using the Secure Hash Algorithm 256 (SHA-256).

The hash is calculated by concatenating four key business parameters with colon separators:

For example, if Supplier GSTIN is 27AABCT3819A1Z5, FY is 2026-27, Doc Type is INV, and Doc Number is INV/0491:

• Concatenated String: 27AABCT3819A1Z5:2026-27:INV:INV/0491
• Resulting SHA-256 Hash: 3a8f9c1e7d2b5046a18d99c30f4e2a10b88c4d29e31a7c5b6e0f2d4a8b1c9e3f

Because SHA-256 is mathematically irreversible and collision-resistant, a seller cannot generate duplicate invoices or alter invoice numbers without changing the resulting IRN.

3. Anatomy of the B2B Dynamic QR Code: Signed JWT Payload

The QR code printed on the final PDF invoice is not a simple website URL; it is a compact, high-density JSON Web Token (JWT) digitally signed by the IRP using asymmetric cryptography (RSA 2048-bit private key). The payload encapsulates:

• sellerGstin: Supplier's 15-character GSTIN.
• buyerGstin: Buyer's 15-character GSTIN.
• docNo: Supplier invoice number.
• docTyp: Document code (INV, CRN, DBN).
• docDt: Date of invoice generation (DD/MM/YYYY).
• totInvVal: Total invoice monetary value inclusive of GST.
• itemCnt: Total count of distinct line items.
• mainHsnCode: 4 to 8 digit HSN code of highest value item.
• irn: 64-character SHA-256 hash.

4. The IRP Generation Pipeline: NIC Portal & GSP Webhooks

Enterprise ERPs (SAP S/4HANA, Oracle ERP Cloud, Microsoft Dynamics, Tally Prime) integrate with the Invoice Registration Portal via authorized GST Suvidha Providers (GSPs):

1. JSON Payload Assembly: The billing system formats line items into the standard einv-schema-v1.03 JSON format.
2. Authentication: Client requests a short-lived Bearer Auth Token using encrypted client credentials.
3. Payload Transmission: The JSON is submitted via HTTPS REST API to endpoints operated by NIC (einvoice1.gst.gov.in).
4. IRP Signing: The IRP computes the IRN, writes it to the central database, appends its digital cryptographic signature, and returns the signed JWT QR string in under 300 milliseconds.
5. PDF Rendering: The billing engine generates the printable 2D QR code (minimum 25 mm x 25 mm) on the physical and PDF invoice.

5. Mobile Field Verification: Cryptographic Public Key Audit

A key engineering achievement of India's GST e-invoicing architecture is Offline Asymmetric Verification:

• Embedded Public Key: The official GST e-Invoice verification mobile app (available to tax officers and businesses) embeds the NIC's public RSA certificate.
• Zero Latency: When the camera sweeps the QR code, the app decodes the base-64 JWT payload, runs the public key over the encrypted signature block, and compares the reconstructed hash with the payload parameters.
• Tamper Proof: If a dishonest driver has edited the physical paper invoice (e.g., altered ₹4,89,200 to ₹48,920 to evade taxes), the mathematical hash immediately mismatches, triggering a bright red "INVALID OR TAMPERED INVOICE" warning on the officer's device.

6. Input Tax Credit (ITC) Ineligibility & Transit Detention Penalties

Failure to generate an approved IRP e-invoice carries severe commercial consequences:

• Invalid Document Status: Under Rule 48(5), an invoice issued without an IRN by a mandated taxpayer is not considered an invoice under law.
• Total Buyer ITC Loss: The recipient business cannot claim Input Tax Credit on the purchase under Section 16(2) of the CGST Act, leading to immediate commercial disputes.
• Highway Consignment Seizure: Under Section 129, goods in transit accompanied by non-e-invoiced bills are subject to detention, with release conditional on paying a 200% penalty of the tax payable.