How to set up and use digital identification in Spain

Cl@ve Móvil is the common identification route for many public services and confirms a short-lived request through the official app or an SMS fallback. Cl@ve Permanente uses DNI or NIE plus a user-set password and can add a one-time SMS code for higher assurance. Both require prior Cl@ve registration.

The Cl@ve registration guide separates basic and advanced levels. Automatic video identification and an invitation letter provide basic registration, which cannot access every service or use Cl@ve Firma. Reviewed video, an existing certificate or DNIe, and in-person registration can provide advanced access.

Certificates, cards, and portals

An FNMT personal certificate is software containing the holder's identity and cryptographic key. It can authenticate and sign on enabled services. DNIe gives Spanish citizens certificate functionality through the physical card, its active certificates, PIN, and compatible reader or NFC setup. A citizen of a participating EU state can sometimes select EU citizen access under eIDAS, but each Spanish service and foreign eID scheme must be connected.

Credentials do not replace portals. The Tax Agency's electronic office controls tax filings. Importass manages Social Security services. Mercurio supports listed immigration authorisations and additions. DEHú centralises notifications from participating administrations. My Citizen Folder shows selected records and files. Regional health, education, tax, and municipal portals can use Cl@ve, certificates, or their own supported access.

For a Spanish citizen with active DNIe, use it or advanced Cl@ve according to the task. For a foreign resident with NIE, obtain advanced Cl@ve for mobile convenience and an FNMT certificate where repeated signing or unsupported procedures justify it. A non-resident EU citizen should test eIDAS on the exact service before building a filing plan. A worker with a phone already recorded by Social Security may use Importass SMS for supported actions. A person unable to obtain digital identity should use the official assisted, in-person, representative, registry, or no-login channel offered by that procedure.

Cl@ve registration validates a DNI or NIE plus its contrast data, such as document validity, issue date, or support number. The applicant supplies a controlled mobile number and email. The invitation-letter route depends on the tax address, so correct that record first if it is stale. The current system also offers automatic or manually reviewed video identification, certificate or DNIe registration, and authorised offices.

A basic Cl@ve record is enough for many consultations but not every high-assurance procedure. Advanced registration is required for stronger authentication and Cl@ve Firma. Cl@ve Permanente activation uses the code from registration and a one-time SMS. The password is personal and should not be set or retained by an agent.

Certificate and representation prerequisites

An FNMT personal certificate requires an eligible NIF or NIE record, compatible configuration, online request code, and identity accreditation through an accepted office, video, DNIe, or other current method. The chosen route's live requirements control. The certificate belongs only to the named individual. A company director, legal representative, employee, tax collaborator, lawyer, or gestor may need a representative certificate, electronic power, professional agreement, or register entry rather than the principal's personal key.

A foreign EU eID can work only when both the foreign scheme and Spanish service expose compatible eIDAS access. It may authenticate without offering every Spanish signature or representation function. Social Security SMS requires the mobile number already recorded in its database. Importass also offers identity review using personal data, a selfie, and an identity-document image for supported procedures when no digital method is available.

Nationality, immigration status, employment, study, or family basis does not automatically create digital access. It can determine which identifier and underlying record exists. A self-employed person or employer may be legally required to interact electronically in contexts where an ordinary private individual can still choose paper or assistance.

Test the exact transaction before a deadline: accepted credential, registration assurance, electronic-signature method, browser and AutoFirma version, permitted representative, attachment limits, payment route, and notification channel. The responsible public body's support page, not a certificate vendor or adviser, decides compatibility.

Prepare the current DNI, TIE, EU certificate, or other accepted identity document; the NIE or NIF exactly as recorded; support number or contrast date; a mobile phone and email controlled by the holder; current tax and Social Security contact details; and appointment or video-verification evidence. Resolve duplicate NIE, misspelled name, or outdated tax-census data before relying on an invitation letter or portal match.

For an FNMT software certificate, install the current configuration tool before requesting. The official application manual requires configuration, request, identity accreditation, and download in order. Keep the request code private and use the same computer and user profile through download without formatting or deleting the generated keys.

Secure storage and authority

After download, export a password-protected backup including the private key. Store it offline in a controlled location separate from the password and test restoration on a secure profile. Do not email the certificate bundle, place it in a shared drive, or leave it installed on an adviser's computer. Record issuer, holder, serial number, issue and expiry, devices installed, backup location, and revocation route.

For DNIe, check card validity, certificate status, PIN, reader or NFC compatibility, and official software. For Cl@ve, retain the registration receipt and activation code securely, but never store the password or one-time codes in the same unprotected note. Ensure the app device has a strong lock and remote-loss controls.

Representation requires a separate file: principal and representative identity, organisation NIF and registry position, legal or voluntary authority, exact procedures or matters, start and end, power-of-attorney registry evidence, professional collaborator status where relevant, revocation terms, and secure communication. A signed service contract does not necessarily create the electronic power a portal requires.

Before filing, compare the applicant shown by the credential with the person legally making the application. Confirm whether the signature must be personal, parental, corporate, or representative. Prepare PDF attachments with readable originals, authentic copies or CSV where accepted, correct file size, and no password encryption unless permitted. Preserve privacy by sharing only required pages and using the portal rather than private email.

1. Open the official procedure page. Do not begin from an advert, mirror form, or private QR code. Confirm the domain, responsible body, procedure title, eligibility, filing window, accepted identity methods, and whether electronic filing is optional or mandatory.
2. Choose enough assurance. Use advanced Cl@ve, FNMT certificate, DNIe, eIDAS, Social Security SMS, or assisted access according to the buttons actually offered.
3. Prepare the device. Update a supported browser, install official certificate components and AutoFirma if required, allow the documented handoff, and test on the authority's validation service.
4. Build the filing. Complete fields from source records, attach readable named files, pay through the official route, and check applicant, representative, notification preference, amount, bank reference, and destination body.

Finish the legal act

5. Authenticate and sign. Login establishes who opened the session. A later signature can confirm the application, attachments, declarations, and payment. Read the summary or signed hash before approval. Never confirm a Cl@ve request whose organisation and verification code do not match the browser.
6. Transmit and wait for acceptance. Do not close the window after signing until the registry response appears.
7. Download proof. Save the justificante or resguardo showing registry number, date and official time, applicant, destination, procedure, attachment list or hash, and CSV. Save the signed application and payment proof too. A screenshot of the completed web form is not equivalent.
8. Track the expediente and notifications. Note the case number, competent unit, status portal, DEHú or specific electronic office, email and phone alerts, response method, and next date.

The Mercurio portal supports specified initial and renewal immigration authorisations plus documents for pending cases. Verify that the exact route is enabled and attach fee proof during filing where required. A TIE fingerprint appointment remains a separate police action.

For Tax Agency, Importass, regional, and municipal services, repeat the same control. After filing, validate the receipt's CSV through the issuing authority, open the expediente, and check that attachments are present. Update contact or representative data only through the body that owns it; changing Cl@ve does not update every government register.

Cl@ve registration and use through official channels are free. The ordinary FNMT natural-person software certificate and official AutoFirma download are also not private subscriptions. Importass, the Tax Agency, DEHú, My Citizen Folder, the general electronic register, and Mercurio do not charge a platform membership merely to access a public file.

Possible supporting costs include travel to an identity-verification office, copies, replacement DNI or TIE, a compatible smart-card reader for DNIe, a secure backup device, internet or phone access, and time away from work. A voluntary qualified certificate stored on a commercial card, corporate certificate, professional certificate, or managed signing service can have provider charges. Compare the official trust list, certificate purpose, validity, hardware, renewal, revocation, support, and export restrictions.

Keep procedure costs separate

Digital identity does not waive the actual tax, immigration tasa, Social Security contribution, court deposit, licence fee, or municipal charge attached to a procedure. Pay only through the public body's current form or authorised payment provider and match the receipt to the filing. A private site that reproduces a government form can add a service fee without becoming the competent authority.

A gestor, lawyer, tax adviser, or IT specialist is proportionate when the underlying filing is complex, representation must be formalised, a company certificate needs correct authority, a deadline failure has legal consequences, or a technical incident must be evidenced. Obtain identity, registration, written scope, fixed or hourly price, tax, disbursements, credential-handling rules, deletion and return of files, and no guarantee of an official outcome.

Never pay someone to register Cl@ve using their phone, store your personal certificate, read DEHú notices indefinitely without formal authority, or approve requests for you. Do not buy a supposed activation code, expedited government login, or premium Mercurio access.

The cheapest resilient setup for many foreign residents is advanced Cl@ve plus a free personal FNMT certificate, with a secure offline backup and direct access to official portals. A Spanish citizen may add DNIe and an inexpensive reader if their devices lack NFC. A person with one simple task can lawfully use an in-person, SMS, assisted, or representative route instead of installing every tool.

Record credential expiry six months ahead. The current FNMT renewal rule allows eligible renewal during the 60 days before expiry if the certificate has not been revoked. Once expired, it cannot be renewed. A certificate already renewed or obtained through another certificate or DNIe can require fresh identity accreditation.

Cl@ve Permanente passwords expire after two years and can be changed earlier. Keep or regenerate the activation code through the official route. Before replacing a phone, update Cl@ve and each agency's contact record, activate the official app on the controlled device, and verify that no unknown device or number remains. Social Security SMS depends on the phone recorded by Social Security, not merely Cl@ve.

Notifications create their own calendar

Use the General Access Point to reach DEHú, My Citizen Folder, the General Electronic Register, powers, and CSV verification. Check the specific Tax Agency, Social Security, immigration, regional, municipal, and court office too, because coverage and legal channels vary.

A mandatory electronic notice can be treated as rejected after ten calendar days without access, subject to the governing procedure. Email and SMS alerts are courtesy messages and their absence usually does not stop the legal clock. Record when a notice became available, when it was opened or rejected, its stated response or appeal period, calendar type, and the authority's official time.

After a name, DNI or NIE, address, nationality, company role, representative, job, graduation, separation, incapacity, or death change, update each affected authority and replace or revoke credentials and powers as appropriate. Changing data in Cl@ve does not silently correct Tax Agency, Social Security, immigration, health, or municipal records.

Before a long trip or departure from Spain, download receipts and notices, ensure a trusted representative has a valid limited power where needed, and retain direct control of credentials. A representative should use their own credential under the power, not the principal's. Test access before any tax, benefit, immigration, or appeal deadline and renew a certificate before the travel date rather than relying on remote identity verification.

If an unexpected Cl@ve prompt, PIN, or SMS appears, reject it and enter the public service by typing or selecting its official address. The Tax Agency's security guidance says Cl@ve codes and approvals are personal and should not be entered into private sites. Review recent files, powers, notifications, tax activity, Social Security data, and immigration submissions for unauthorised acts.

After phone theft, certificate loss, malware, shared-device exposure, or private-key disclosure, change Cl@ve credentials, recover the phone account, revoke the certificate through FNMT, remove installed copies, revoke unknown powers, and notify affected bodies. A backup is for recovery from device failure, not for continuing to use a key known to be compromised.

Technical failure and deadline protection

When login works but signature or transmission fails, capture the official URL, procedure, date and time, error code, full message, browser and operating system, AutoFirma and certificate versions, file size, and support ticket. Save draft data without exposing the private key. Check the authority's incident notice and permitted alternative registry or in-person channel.

Do not assume an error screenshot filed the application. A valid result is the registry justificante with official time, number, destination, and submitted content. If the public system formally reports an outage, preserve its announcement and any stated deadline extension. Submit through an authorised alternative before expiry where possible and explain the incident in the filing.

For a DEHú notice missed after ten calendar days, download the notice and access audit, calculate the underlying response or appeal deadline, and seek immediate procedural advice. Lack of an email alert alone is rarely enough. A proven platform outage, impossible access not attributable to the user, defective notice, or wrong electronic-service obligation can support a remedy depending on the law and facts.

Start with the portal's official technical support for access, then the competent case office for procedural effect. Use the General Register only when it is legally accepted for that communication. Request a written decision for rejected evidence or late treatment. A qualified administrative, tax, labour, or immigration professional is proportionate when status, benefits, penalties, removal, business operation, or an appeal depends on restoring the deadline.