The Three Real Integration Paths — Not Two
Most comparisons frame this as a binary choice: the MyInvois portal or the API. In practice there are three paths, and the third is the one vendor blogs tend to skip past. You can submit through LHDN's web portal manually, you can integrate your own system directly against the MyInvois API, or you can route through an LHDN-recognised intermediary — a Peppol access point or a non-Peppol technology provider — that operates the integration on your behalf.
LHDN reported more than 1.5 billion e-invoices issued and over 230,000 taxpayers onboarded as of June 2026 (Bernama, via Malay Mail). At that scale, "which path" is no longer a theoretical question for most businesses still on the portal — it's a decision that's already overdue.
When the Portal Is Actually the Right Call
The portal is not a lesser option for the right profile: low transaction volume, no in-house engineering capacity, and invoices that come from a handful of predictable sources. It supports manual entry and bulk upload via a spreadsheet template, with a 72-hour window to cancel or reject a submission after validation.
What breaks down as volume grows is simple arithmetic: manual entry time per invoice doesn't shrink, and error rate on high-line-item invoices climbs. Most businesses in this position haven't acted yet — Xero-commissioned research found only 30% of Malaysian SMEs report fully understanding what e-invoicing requires, and 19% haven't taken any implementation steps at all. If that's your business, the portal is the correct starting architecture, not a placeholder for "real" integration.
What Direct API Integration Actually Requires
This is the part most comparisons gloss over as "connect your system to the API." Direct integration means your system owns five things, not one:
- OAuth 2.0 authentication against LHDN's service, renewed and monitored, not a one-time setup step.
- UBL 2.1 / PEPPOL BIS 3.0 serialisation of every invoice field LHDN requires, including identifiers most billing systems don't currently capture.
- Asynchronous validation polling — submissions aren't validated synchronously, so your system needs to handle "pending," "valid," and "invalid" as real states, not assume an immediate answer.
- Signing-certificate management, with expiry monitoring built in from day one. An expired certificate doesn't degrade service — it blocks every submission until it's renewed.
- Rejection handling that parses LHDN's error codes into something a finance team can act on, rather than routing every rejection into a support ticket.
Regardless of which exemption bracket a business sits in, any single transaction over RM10,000 must be issued as a full e-Invoice — a rule independent of annual turnover. Our technical implementation guide covers the full architecture for teams building this themselves.
Peppol vs Non-Peppol Intermediaries — What You're Actually Paying For
An intermediary doesn't remove the compliance obligation — it moves who operates the OAuth, UBL, and certificate stack from your team to theirs. That's a legitimate trade: you're buying operational ownership, not an exemption. A Peppol access point routes through the broader Peppol network's standards; a non-Peppol technology provider connects directly to MyInvois using its own integration.
Before signing with either, get clear answers on three things: the certificate renewal process and who's responsible for it, who's liable if a submission is rejected or late, and where your invoice data is stored. We don't recommend specific vendors here — that diligence is yours to do, and the answers should be in writing before you commit.
The Actual Decision Framework
Three questions settle this, in order:
- Monthly invoice volume. Low and predictable favours the portal; high or growing favours API or an intermediary.
- In-house engineering bandwidth. If nobody on your team can own OAuth, UBL formatting, and certificate renewal as an ongoing responsibility — not a one-off project — an intermediary absorbs that, at a cost.
- Tolerance for LHDN's spec changing under you. The requirements have already moved more than once since launch (see below). Direct integration means your team absorbs every future change; an intermediary means someone else does, for a fee.
There's no universally "better" answer — only the answer that matches your volume and capacity today.
What Changes If You Get This Wrong
The cost of the wrong choice isn't abstract. For a direct integration, it's an expired signing certificate silently blocking every outbound invoice until someone notices. For a portal-only setup past its volume ceiling, it's a finance team buried in manual entry during month-end close.
The compliance bar itself keeps moving, which is exactly why the architecture needs to tolerate change, not assume today's rules are final. The annual turnover exemption threshold was raised from RM500,000 to RM1,000,000, and a planned phase mandating e-invoicing for businesses in that RM500k–RM1m band was cancelled outright following a Cabinet decision in December 2025. Businesses below the new threshold can still register voluntarily, but nothing forces them to yet — and that line has already moved once.
If your organisation is weighing this decision now, we build and maintain both the direct-integration path and the surrounding automation — certificate monitoring, rejection handling, and the retry logic that keeps a billing pipeline running when LHDN's side is slow. If you'd rather see the trade-offs mapped against your own invoice volume before committing either way, we're happy to work through it with you.
