My invoice download link has expired. What now?

First check the supplier's customer account, where the invoice is often still available. For invoices sent through Stripe, an expired link leads to a page where recipients of the original email can usually request a fresh copy with working links. If neither works, ask the supplier for a copy of the invoice; a self-issued replacement receipt is only a last resort.

Do I need to keep the email that contains the invoice link?

Usually not. Germany's GoBD rules treat an email that only transports an invoice like an envelope, which doesn't have to be kept. What you must retain is the invoice itself, meaning the downloaded file. If the email contains additional information, such as agreements about the service, keep it as well.

Is it enough that the invoice stays in the supplier's portal?

No. In Germany you must keep incoming invoices for eight years, and how long a supplier keeps them in its portal is entirely up to the supplier. After a cancellation, or when the login belongs to someone who has left, you often can't get to them any more. Download the invoice and store it in your own archive.

How can I tell whether an invoice email is phishing?

Check the actual sender address and the link target before clicking, and be suspicious of threats about reminders or account suspension. Reputable providers don't ask you to disclose login details by email. The safest approach, also recommended by Germany's Federal Office for Information Security (BSI), is to open the customer portal from a bookmark or the provider's homepage instead of the link in the email.

Can I download invoices from supplier portals automatically?

Yes, with a tool that logs into the portal with your credentials. belege.ai downloads invoice links directly and hands login pages to a browser agent that signs into the supplier portal; two-factor codes come from the connected mailbox, via Telegram or from 1Password. There are limits: CAPTCHAs aren't solved, not every portal works, and the agent doesn't log into the PayPal portal.

Which file do I keep for an e-invoice downloaded from a portal?

The structured file: the XML of an XRechnung, or the ZUGFeRD PDF with the XML embedded. According to Germany's finance ministry, at least the structured part of an e-invoice must be kept intact in its original form. A PDF view or printout is only a reading aid and doesn't replace the original.

Invoice Only Available as a Download Link? How to Get the PDF

Q: Is an invoice sent as a download link valid?

Yes, the delivery route doesn't make an invoice invalid. The invoice is the document behind the link, not the notification email, and for e-invoices Germany's finance ministry explicitly lists download via an internet portal as a permitted route. For PDF invoices, German VAT law requires your consent to electronic transmission, and like any invoice the document must contain all mandatory details.

If an invoice email only contains a link, the email is just the notification — the invoice is the file behind the link, and you have to download and keep it yourself. Do it promptly: some links stop working after a few weeks, and a supplier's portal is not an archive. If the link leads to a login page, open the portal from your own bookmark rather than from the email. And where the supplier offers it, switch delivery to PDF attachments.

Why invoices arrive as links instead of attachments

“Your invoice is ready”, “Your bill is available online”: many of these emails carry a button, not a PDF. Suppliers have their reasons:

One place for all documents: invoices, credit notes and contracts live together in the customer account.
Data protection: the German hosting provider Host Europe, for example, only sends invoices to contacts registered in the customer account, citing data protection.
Deliverability and size: attachments can trigger spam filters, and large statements quickly hit size limits.
Payment pages: billing platforms such as Stripe offer hosted invoice pages where you can view the invoice, pay it and download it as a PDF.
E-invoicing platforms: structured e-invoices are sometimes provided for download as an XML file or a ZUGFeRD PDF.

So “invoice only as a link” covers four different cases:

Link type	How to recognise it	What you should do	What automation can do
Direct file link	One click opens the PDF, no login needed.	Save the file as the original — not just the link.	Easy: a tool can fetch the file without logging in.
Tokenised link that expires	A long random string in the URL, often a hosted invoice or payment page.	Download it the day it arrives; once it has expired, request a new copy.	Works while the link is valid — automation has to run promptly.
Customer portal with login	The link lands on a sign-in page or “your account”.	Open the portal from a bookmark, download the invoice, turn on PDF attachments if offered.	Needs stored credentials and a way to handle two-factor authentication; CAPTCHAs are a hard stop.
E-invoice download	You're offered an XML file, such as an XRechnung, or a ZUGFeRD PDF.	Keep the structured file in its original form, not just a print view.	Software can read the data directly — but the original still has to be archived.

The email isn't the invoice: what German law says

The rules below are German law; elsewhere, retention periods differ, but “keep the document, not the link” is a safe default anywhere. Under Section 14(1) UStG, the German VAT Act, an invoice is any document that bills a supply of goods or services, whatever it's called. A “your invoice is ready” email only points to that document — the file behind the link is the original invoice you check, book and retain.

So is an invoice sent as a link valid? The delivery route doesn't make it invalid. For e-invoices, the German Federal Ministry of Finance's e-invoicing FAQ (in German) says the law prescribes no particular route and explicitly lists download via an internet portal alongside email and electronic interfaces. For a PDF invoice — a “sonstige Rechnung” (other invoice) in German VAT terms — Section 14(1) UStG requires the recipient's consent to electronic transmission; with online billing in a customer account, that consent is usually part of your agreement with the supplier. The content itself you check as with any invoice.

What you retain is the invoice, not the link. Under Section 14b UStG and Section 147 AO, the German Fiscal Code, incoming invoices must be kept for eight years, counted from the end of the calendar year in which they were issued, with authenticity of origin, integrity of content and legibility ensured throughout. A bookmark to a portal you don't control does none of that.

For an e-invoice, the structured part is what counts: according to the finance ministry, at least that part has to be stored so that it remains intact in its original form. If a portal offers both a PDF view and an XML download, archive the XML file — or the ZUGFeRD PDF with the XML embedded. The view is only a reading aid. More in our German guide E-Rechnung empfangen.

And the notification email? Germany's GoBD — the finance ministry's rules for keeping records electronically — compare an email that merely carries an invoice to an envelope: if it contains no other information that must be retained, you don't have to keep it.

A customer portal is not an archive

“It's in the portal anyway” is the riskiest thought here. How long an invoice stays there is up to the supplier alone — your eight-year retention duty doesn't bind them. And there are practical risks:

Cancellation: after a contract ends, access to the customer account can be restricted or closed.
People leave: the account runs on the email address and phone of someone who no longer works for you.
Links expire: for invoices sent through Stripe, invoice URLs expire 30 days after the due date according to Stripe's documentation — 30 days after the invoice is finalised if there is no due date, and never later than 120 days. Recipients of the original email can usually request a fresh copy with working links from the expiry page.
Hidden history: some portals only show recent invoices by default — Host Europe initially lists just the last five.

Tip: switch to PDF attachments

Many suppliers let you choose between a notification only and the invoice as a PDF attachment. Look for billing notification or invoice delivery settings in your account. Two examples:

Microsoft 365: depending on your billing account type, go to Billing → Billing notifications in the admin center, choose Edit notification settings and tick “Attach a PDF to your invoice emails” — or open your billing profile under Billing → Billing accounts and turn on “Get invoices in email attachments” (Microsoft's instructions).
Host Europe: in the customer information system (KIS), under Kundenkonto → Rechnungen (account → invoices), you set per contact whether they get no information, a notification only — then you fetch the invoice in KIS — or the invoice as a PDF attachment. According to Host Europe's FAQ (in German), newly added contacts get no notification by default.

Send those attachments to a shared address rather than a personal inbox — here's how to set up an invoice email address.

A manual routine that works — and where it breaks

Until every supplier sends attachments, you need a fixed process — for example a monthly portal round a few days into the month:

Keep a portal list. One row per supplier: portal URL (saved as a bookmark), whose login it is, the two-factor method (SMS to whose phone, authenticator app, code by email), where invoices live in the menu, and how often they arrive.
Collect the link emails. Search for subjects like “invoice available”, “your bill is ready” or, from German suppliers, “Rechnung steht bereit”. Our guides for Gmail, Outlook and IMAP mailboxes show how to label them automatically.
Don't let expiring links sit. Hosted invoice pages and links that mention an expiry get downloaded the day they arrive.
Work through portals from bookmarks. Download last month's invoices, including credit notes and corrections. Never log in through the email link.
Name files consistently. For example 2026-09-05_Supplier_INV-12345.pdf: invoice date, supplier, invoice number. An e-invoice's XML file gets the same name with .xml.
Store files unchanged. No screenshots, no print-and-rescan: the downloaded file is the original.
Tick them off against the bank account. Every debit needs an invoice — see the invoice reconciliation workflow.

In practice, the routine breaks in the same places every time:

Two-factor authentication: the SMS code goes to a colleague who is on holiday, or to a number that no longer exists.
Forgotten portals: annual plans, domain renewals and tools someone bought with the company card aren't on any list — until your accountant asks for the receipt.
Expired links: skip one round and you find an expiry page instead of an invoice.
Volume: ten portals mean ten logins with potentially ten different two-factor methods — every month.

Phishing: when the invoice link is the trap

“Your invoice is ready — click here” is a popular phishing template precisely because every business gets these emails constantly. The fake leads to a copied login page that harvests credentials, or to malware. The rules of Germany's Federal Office for Information Security (BSI) apply directly:

Check the sender: the display name can hide a different address, so check that the real sender's domain belongs to the supplier.
Check the link before clicking: hover over the button and read the address. Be wary of familiar names with odd numbers or characters added, and of short links that hide the real destination.
Never enter credentials via an email link: reputable providers don't ask you to disclose access data by email. Open the portal from a bookmark or the supplier's homepage — the BSI explicitly recommends bookmarking login pages you use often.
When in doubt, download from the supplier's website: the BSI also advises against starting a download from an email you can't fully trust.
“https” proves nothing: fraudsters use encrypted connections too.
Ignore pressure, verify separately: reminders, suspension threats and “final deadlines” are classic phishing. If an invoice comes from a company you don't deal with, contact them through details you already know.

The BSI's full guidance, in English: recognising phishing and protecting yourself against phishing.

How belege.ai handles invoice links and portals

belege.ai turns the routine around and starts from your bank transactions. For every open payment, the agent searches your connected mailboxes — Gmail, Outlook/Microsoft 365 or via IMAP — for the matching invoice, looking not only at attachments but also at email bodies and links.

Direct links: if an HTTPS link in the invoice email leads to the file, the agent downloads it.
Login pages: if the link lands on a sign-in page, the agent hands the URL to its browser agent, which logs into the supplier portal and downloads the invoice. You store your portal logins once through a protected browser session, and they are kept encrypted.
Two-factor authentication: sessions are kept alive between runs. Codes sent by email are read from the connected mailbox, SMS or app codes are requested from you via Telegram, and authenticator (TOTP) codes can come from 1Password.
Only with a reason: the agent only logs into a portal when there is evidence the invoice is there.
Forwarding address: HTTPS links in emails you forward to your personal belege.ai address are downloaded too. If such a link leads to a login page, you're asked to download the invoice yourself.

The invoice is then read, checked and matched to the payment, ready for your tax advisor (Steuerberater) at month end. If the agent finds nothing, it asks you in Telegram; a self-issued replacement receipt (Eigenbeleg) is only created with your explicit OK. The limits: no CAPTCHA solving, not every portal works (many do), and no login to the PayPal portal. The daily scan of new mail reviews PDF attachments but doesn't follow links — links and portals are handled for open payments. More on automated invoice collection in Germany.

Common mistakes

Filing the notification instead of the invoice: a forwarded “your bill is online” email isn't a receipt.
Waiting until year end: by then links have expired, contracts are cancelled and logins forgotten.
Keeping screenshots or print views: keep the file as you received it; for e-invoices, that means the XML.
Downloading the wrong document: portals often offer an order confirmation and a payment receipt next to the invoice — you need the invoice.
Tying logins to individuals: if the account runs on an employee's address, access to the invoices often leaves with them.
Filing twice: if the same invoice later also arrives as an attachment, check the invoice number before filing — see how to prevent duplicate invoices.

Checklist

Portal list with URL, login owner, two-factor method and billing rhythm
PDF attachments switched on wherever the supplier offers them
Invoice recipient changed to a shared invoice address
Portal logins tied to role addresses, not individuals
Expiring links downloaded the day they arrive
Portals opened only from bookmarks, never from the email link
Original saved: the PDF as downloaded, the XML file for e-invoices
Named consistently, stored unchanged and available for eight years
Every debit ticked off against an invoice