When generating an e-invoice through Tally Prime, SAP, Zoho Books, or an ERP connector, accountants frequently encounter errors mentioning digital signature verification or authentication failures. Common messages include: 2147: Unable to sign invoice, Pl try after some time, or API error 1005: Invalid Token. Understanding how digital signatures work on the Invoice Registration Portal (IRP) prevents erroneous invoice cancellations and duplicate document numbers.
Who signs the e-invoice: the supplier or the portal?
A common misconception among business owners is that their own Digital Signature Certificate (DSC) dongle must sign each invoice JSON payload before transmission to the portal. Under Rule 48(4) of the CGST Rules, the notified registered person uploads the invoice particulars in FORM GST INV-01 schema to the Common GST Electronic Portal. The portal validates the fields, generates a 64-character Invoice Reference Number (IRN), embeds a signed QR code, and digitally signs the entire invoice payload with the National Informatics Centre (NIC) certificate.
In addition, under the sixth proviso to Rule 46 of the CGST Rules, the physical or digital signature of the supplier or his authorised representative is not required on an invoice issued electronically in accordance with the Information Technology Act, 2000. When an e-invoice contains the valid IRP digital signature and QR code, the document is legally complete without any manual DSC stamping.
Signing requirement: The supplier signs GST returns (like Form GSTR-1 or Form GSTR-3B) with DSC or EVC, but individual e-invoices uploaded to the IRP under Rule 48(4) are digitally signed by the government portal itself.
Common digital signature and authentication error codes
Errors flagged as signature or authentication problems on the NIC e-Invoice Portal Error Codes Master fall into two distinct operational categories:
| Error code | System error message | Underlying cause | Correct resolution |
|---|---|---|---|
| 2147 | Unable to sign invoice, Pl try after some time | Internal IRP signing server bottleneck or temporary timeout | Do not modify invoice data. Wait 5 minutes and check e-invoice status before resubmitting. |
| 1005 | Invalid Token | Authentication token expired (validity is 6 hours) or header GSTIN mismatch | Regenerate the auth token via Auth API or re-login in your ERP connector. |
| 1013 | Decryption of password failed | Wrong public key used for encrypting the password | Download the latest production public key from the e-invoice portal user management. |
| 1016 | Decryption of App Key failed | Outdated or mismatched public encryption key in API client | Refresh the API secret key and symmetric app key in your ERP settings. |
| 2265 | Recipient GSTIN state code does not match recipient details | State code prefix mismatch in buyer details | Align recipient state code with the first two digits of recipient GSTIN. |
Troubleshooting IRP error 2147: unable to sign invoice
When the IRP returns error code 2147, the invoice payload passed validation, but the portal signing module failed to append the cryptographic signature. Many accountants immediately click upload again or create an amended invoice number in their billing system. This is a mistake.
If the portal completed IRN creation before the network cut off, firing another upload with the exact same invoice number returns Error 2150: Duplicate IRN. Because an IRN once generated cannot be modified or re-registered under Rule 48, creating a second invoice causes numbering gaps in your books.
- Check portal status: Log in to einvoice1.gst.gov.in, navigate to Search, and click e-Invoice Status. Enter your document number, document type, and financial year.
- Retrieve existing IRN: If the IRN shows as active, download the signed JSON and QR code directly into your ERP without resubmitting.
- Resubmit if unrecorded: If the search confirms no document was registered, resubmit the original payload through your API bridge.
Resolving API authentication and token errors (1005, 1010, 1013)
Direct ERP integrations (GSP or API mode) rely on JSON Web Tokens and asymmetric encryption. The official API technical guidelines on the NIC e-Invoice Portal Resolution Errors list specific authentication rules:
- 6-Hour token lifespan (Error 1005): The authentication token remains valid for exactly 6 hours. If your automated background sync sends requests after this window without invoking the Auth API, every transmission fails. Configure your software to refresh authentication every 5 hours.
- Public key mismatch (Error 1013 and 1016): The public certificate used to encrypt passwords and symmetric application keys differs between the Sandbox test environment and the Production environment. Never use Sandbox certificates on the live portal.
- Header matching: The GSTIN passed in the API request header must match the GSTIN of the authenticated user. If a multi-branch business uses a single head-office login without sub-user mapping, the IRP blocks the call.
Verifying the digital signature on received vendor e-invoices
When receiving inward supplies from vendors, accounts teams must verify that the e-invoice is genuine. An authentic e-invoice contains a digital signature issued by NIC or authorized IRPs, not the vendor's private signature.
PDF reader warning: When opening an e-invoice PDF in Adobe Acrobat Reader, the signature may display a yellow question mark stating "Validity Unknown". This happens because your local operating system does not have the NIC Root CA installed in its trusted certificate store. It does not mean the invoice is invalid.
To verify the vendor invoice signature definitively, use the official e-Invoice QR Code Verifier mobile app published by GSTN or verify the signed JSON file using the public certificate available on the portal. Once validated, the invoice data automatically populates into your supplier's Form GSTR-1, as documented in the GSTN GSTR-1 FAQ on e-invoice auto-population, flowing into your GSTR-2B inward statement.
If you discover that an e-invoice was issued with incorrect tax rates or recipient details, remember that cancellation on the IRP is permitted only within 24 hours. After that window, refer to our guide on e-invoice cancellation after the 24-hour deadline to issue appropriate credit notes under Section 34.
Worked example: resolving invoice authentication and tallying tax
Consider an enterprise, Apex Industrial Components (turnover ₹18 crore), issuing an interstate tax invoice to an engineering client in Karnataka. The billing team encounters error 1005 during batch generation, followed by state code validation error 2265.
| Document field | Initial ERP payload | IRP validation check | Correction applied |
|---|---|---|---|
| API Header Token | Generated 08:00 AM, used at 03:30 PM | Error 1005 (Token expired > 6 hours) | API invoked fresh Auth call; new token issued |
| Recipient GSTIN | 29AAACB1234F1Z5 (Karnataka) | Valid active GSTIN | No change required |
| Recipient State Code | 27 (Maharashtra) | Error 2265 (State code mismatch) | Corrected state code to 29 matching GSTIN |
| Taxable Value | ₹2,50,000 | Calculated line items match total | Assessable value: ₹2,50,000 |
| IGST (18%) | ₹45,000 | ₹2,50,000 × 18% = ₹45,000 | Total Invoice Value: ₹2,95,000 |
| IRP Signature | Pending portal response | IRN generated & digitally signed | 64-digit IRN and signed QR code recorded |
By regenerating the authentication token and aligning the state code to 29, the payload successfully validated. The IRP generated the IRN, digitally signed the invoice, and returned the QR code payload without requiring any local DSC token on the billing terminal.
Related guides
- E-invoice error 2265: HSN code digit length mismatch and turnover rules
- E-invoice error 2283: resolving recipient GSTIN inactive, cancelled, or suspended status
- E-invoice error 2278: duplicate IRN on cancelled document explained
- How to fix excel to json error in GSTR-1 offline tool: troubleshooting guide
- E-way bill Part B vehicle update error fix
Frequently asked questions
Does the supplier need to digitally sign the JSON payload before sending it to the IRP?
No. The supplier uploads the unsigned invoice payload in Form GST INV-01 schema using API authentication or offline JSON upload. The IRP validates the document, generates the 64-character IRN, embeds the QR code, and affixes its own digital signature to the invoice payload.
Is a physical or digital signature required on printed e-invoices?
Under the proviso to Rule 46 of the CGST Rules, the signature or digital signature of the supplier or his authorised representative is not required on an electronic invoice issued in accordance with the provisions of the Information Technology Act, 2000, provided it bears the IRP QR code and IRN.
How do you fix NIC error 2147 unable to sign invoice?
Error 2147 is a transient server-side error where the IRP encounters an internal failure while affixing its digital signature. Do not change invoice details or create duplicate serial numbers. Wait a few minutes and re-query the e-invoice portal before resubmitting.
Why does the e-invoice API return error 1005 invalid token?
Auth tokens generated on the e-invoice portal expire after 6 hours. Error 1005 indicates that your accounting software is using an expired session token or that the GSTIN and User ID in the API request header do not match the token payload.
Check your vendor e-invoices in GSTR-2B
When your suppliers generate valid e-invoices, the details auto-populate into their GSTR-1 and reflect in your GSTR-2B. Match your purchase register against monthly GSTR-2B statements instantly to detect missing vendor invoices, rate discrepancies, or incorrect GSTINs. Your GSTR-2B and purchase register files are read in your browser and never uploaded to any server.
Last checked: 21 October 2026. Sources: CBIC CGST Rules Rule 48, CBIC CGST Rules Rule 46, NIC e-Invoice Portal Error Master, NIC e-Invoice Portal Resolution Errors, GSTN GSTR-1 User Guide.