How to Validate EU VAT Numbers in Node.js

1. The problem with EU VAT validation

At first glance, validating a VAT number in a Node.js app seems trivial — just check the format, right? But EU VAT numbers span 27 member states, each with its own structure, length, character set, and checksum algorithm. And format validation is only half the story: a number that looks correct might still be unregistered, suspended, or belong to a dissolved company.

If your app invoices B2B customers in Europe, incorrect VAT handling carries real tax liability. This guide walks through the failure modes and the practical solution.

2. The naive approach: regex (and why it fails)

The first thing most developers try is a simple regex. Something like this:

// ❌ DO NOT USE — this will reject valid VAT numbers
const EU_VAT_REGEX = /^(AT|BE|BG|HR|CY|CZ|DK|EE|FI|FR|DE|EL|HU|IE|IT|LV|LT|LU|MT|NL|PL|PT|RO|SK|SI|ES|SE)[0-9A-Z]{8,12}$/;

function validateVat(vat) {
  return EU_VAT_REGEX.test(vat.toUpperCase().replace(/\s/g, ''));
}

validateVat('DE123456788');   // true  ✓ (but might not exist)
validateVat('FR12345678801'); // false ✗ (actually valid — FR allows letters!)
validateVat('EL123456788');   // false ✗ (Greece uses EL, not GR)
validateVat('IE1234567FA');   // false ✗ (Ireland's format: digit + 5 digits + 2 letters)

To handle all EU countries correctly, you'd need 27 separate regexes — plus checksum verification logic for many of them (Germany, Poland, Italy, Spain, etc. all use country-specific check digit algorithms).

3. Why VAT validation is genuinely hard

4. The right solution: one API call

Instead of maintaining 27 country-specific validators plus VIES integration, use the IsValid VAT API. A single GET request handles format validation, checksum verification, and optional VIES lookup — for 60+ countries.

Get your free API key at isvalid.dev. The free tier includes 100 calls per day — enough for most development and low-volume production use.

Full parameter reference and response schema: VAT Validation API docs →

5. Node.js code example

Using the IsValid SDK or the native fetch API.

import { createClient } from '@isvalid-dev/sdk';

const iv = createClient({ apiKey: process.env.ISVALID_API_KEY });

// ── Example usage ────────────────────────────────────────────────────────────

const result = await iv.vat('DE123456788', { checkVies: true });

if (!result.valid) {
  console.log('Invalid VAT format or checksum');
} else if (result.vies?.checked && !result.vies.valid) {
  console.log('Format OK, but not found in VIES — may be suspended or not yet registered');
} else if (result.vies?.checked && result.vies.valid) {
  console.log(`Active EU VAT: ${result.vies.name}`);
} else {
  console.log(`Format valid — ${result.countryName}`);
}

6. cURL example

Format + checksum validation only (fast, no VIES call):

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.isvalid.dev/v0/vat?value=DE123456788"

With VIES registration check (slower — queries EU servers):

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.isvalid.dev/v0/vat?value=DE123456788&checkVies=true"

With explicit country code (useful when the number has no prefix):

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.isvalid.dev/v0/vat?value=123456788&countryCode=DE"

7. Understanding the response

Response for a valid German VAT number with VIES check enabled:

{
  "valid": true,
  "normalized": "123456788",
  "countryCode": "DE",
  "countryName": "Germany",
  "isEU": true,
  "vies": {
    "checked": true,
    "valid": true,
    "name": "EXAMPLE GMBH",
    "address": "MUSTERSTRASSE 1\n10115 BERLIN"
  }
}

When checkVies is omitted or false, the vies field is not included in the response. When VIES is unreachable, vies.checked is false and vies.reason is "unavailable".

8. Edge cases to handle

// Handle suspended / deregistered VAT
if (result.valid && result.vies?.checked && !result.vies.valid) {
  // Format OK, but not in VIES — reject or flag for manual review
  throw new Error('VAT number is not currently registered');
}

if (result.vies && !result.vies.checked) {
  if (result.vies.reason === 'unavailable') {
    // VIES is temporarily down — do not reject, log and retry later
    logger.warn('VIES unavailable for', vatNumber);
    return { valid: result.valid, viesStatus: 'unavailable' };
  }
  if (result.vies.reason === 'not_eu') {
    // Non-EU country — no VIES check possible, format-only validation
    return { valid: result.valid, viesStatus: 'not_applicable' };
  }
}

async function validateVatSafe(vatNumber, options = {}) {
  try {
    return await validateVat(vatNumber, options);
  } catch (err) {
    // Log and decide: fail open (allow) or fail closed (reject)
    logger.error('VAT validation failed:', err.message);
    return { valid: null, error: 'validation_unavailable' };
  }
}

Node.js integration notes

When handling EU VAT Number in a TypeScript codebase, define a branded type to prevent accidental mixing of financial identifier strings at compile time:type VatNumber = string & { readonly __brand: 'VatNumber' }. The IsValid SDK ships with full TypeScript definitions covering all response fields, including country-specific and instrument-specific data, so your editor provides autocomplete on the parsed result without manual type declarations.

In financial data pipelines — payment processors, reconciliation engines, or KYC workflows — EU VAT Number validation sits at the ingestion boundary. Pair the IsValid SDK with decimal.js orbig.js for any monetary amounts tied to the identifier, and usepino for structured logging that attaches the validation result to the transaction reference in every log line, making audit trails straightforward.

Error handling should distinguish between a 422 response from IsValid (the EU VAT Number is structurally invalid — return this to the caller immediately) and 5xx or network errors (transient failures — retry once after a short delay before surfacing a service-unavailable error). Never swallow validation failures silently; they indicate bad data that could propagate into financial records downstream.

• Assert process.env.ISVALID_API_KEY is present at server startup, not lazily at first request
• Use Promise.allSettled() for batch validation — it collects all results without aborting on the first failure
• Mock the IsValid client with jest.mock() in unit tests; keep CI pipelines free of real API calls
• Store the full parsed API response alongside the raw EU VAT Number in your database — country code, institution data, and check-digit status are useful for downstream logic

When making HTTP calls to the IsValid API directly (without the SDK), the choice between fetch and axios is largely a matter of preference. The native fetch API is available in Node.js 18+ without any additional dependency and is sufficient for simple request/response flows. axios adds automatic JSON parsing, request/response interceptors, and a cleaner timeout API (axios.create({ timeout: 5000 })), which makes it easier to centralise the Authorization header and retry logic in one place. For high-throughput services that make many concurrent API calls, consider undici — the HTTP client underlying Node.js fetch — used directly for its connection pooling and lower overhead.