Guide to Obtaining a Digital Certificate or Cl@ve in Spain

Your key to accessing Spanish government services online

Last updated: March 4, 2025

Navigating Spanish bureaucracy becomes significantly easier when you have secure online access to government services. This guide explains how to obtain a Digital Certificate (Certificado Digital) or set up Cl@ve – the two main methods for securely identifying yourself online with Spanish authorities.

1. What Is a Digital Certificate and Why Is It Useful?

A Digital Certificate in Spain is essentially your secure online ID – an encrypted electronic file issued by the Spanish Royal Mint (FNMT-RCM) that contains your personal identification data. It links your identity to a digital key and allows you to prove who you are online with full legal validity, just like showing a passport or ID card but over the internet.

Anyone over 18, including foreign residents with a NIE (Foreigner ID Number), can obtain a digital certificate free of charge. This certificate lets you authenticate on government websites and sign documents digitally, with the same legal standing as a handwritten signature.

Why It's Useful

With a digital certificate, you can access a wide range of Spanish government services from home, avoiding in-person visits. You can file taxes, check or pay fines, request social security benefits, obtain a "padron" certificate, or even get a Spanish criminal record certificate online.

It simplifies bureaucracy by letting you handle official paperwork securely via the internet. Instead of waiting in queues or struggling with language in person, you can do tasks in English on your computer using translation tools if needed.

What About Cl@ve?

Spain also offers an alternative called Cl@ve, a unified electronic identification system. Instead of a file installed on your computer, Cl@ve is a login service that lets you verify your identity via a username/password or one-time PIN code.

Both Cl@ve and the digital certificate serve the same purpose: secure online identification for e-government services. You can choose either (or even have both) based on your preferences and needs.

The Cl@ve System Has Two Modes

  • Cl@ve PIN

    A one-time PIN code method for occasional use. Each login, you request a temporary code sent by SMS or generated in the Cl@ve mobile app. It's very simple – you don't have to remember a long password – and the code expires after use, which adds security.

  • Cl@ve Permanente

    A permanent account (username + password) for frequent use, linked to your DNI/NIE. This is like a long-term password login, but for high-security actions it also requires an additional one-time SMS code (two-factor authentication). Once set up, Cl@ve Permanente allows use of Cl@ve Firma, a cloud signature service for signing documents online.

2. How to Obtain a Digital Certificate (Step-by-Step)

Obtaining an FNMT digital certificate involves three main steps: (1) completing an online request on the FNMT website (which generates a code), (2) proving your identity in person at an official office, and (3) downloading/installing the certificate on your computer. Below is a detailed walkthrough:

1Prepare Your Computer & Access the FNMT Website

Before filling out the request, install the small FNMT software that helps with certificate generation:

  • On the FNMT's official site, go to the section for Certificados Personales (Personal Certificates)
  • Look for a link like "Configuración Previa" (Pre-configuration) or "Download FNMT-RCM Configurator"
  • Download and run this tool, which is available for Windows, Mac, etc.
  • Grant it permissions to install

This tool sets up your browser to generate and store the certificate keys. It's recommended to use the same computer and browser for the entire process. Don't format or heavily update your system between the request and download steps, or the certificate might not install properly.

2Submit an Online Certificate Request

On the FNMT site's "Solicitar Certificado" (Request Certificate) page, you'll fill out a form with your identification details:

  • ID Number: Enter your NIE or DNI (the number on your residency card or Spanish ID). Use the format as it appears on your card (for NIE, letter + 7 digits + letter, no spaces)
  • Surname: Enter your first last name (apellido) exactly as it appears on your ID
  • Email: Provide a current email address you have access to

After filling these, click the button to view and accept the conditions. Scroll through the terms, then check the box agreeing to them. Now submit the request (often a button like "Enviar petición").

The browser will then launch the FNMT configurator app you installed – it will prompt you to create a password for your certificate request. Choose a strong password and remember it (write it down securely). This password protects the certificate's private key; you'll need the same password later to download the cert.

After setting the password, you should see a message that the request was successful. The system will send you a unique Application Code (Código de solicitud) by email. Save that code – print the email or write it down – as you'll need to present it for identity verification and again to download the certificate.

3Verify Your Identity in Person

After the online request, the FNMT requires an in-person identity proof (this step is mandatory for security). With your application code in hand, make an appointment at a registration office to verify your identity.

The most common place is your local Agencia Tributaria (Tax Office), since they act as FNMT registration offices. You can use the FNMT's office locator tool to find the nearest authorized office (many town halls and government offices can do this).

Appointment:

Many offices require a cita previa (appointment). On the Tax Agency's website you can book a slot for "Acreditación Certificado Digital FNMT" (FNMT digital certificate identification).

On the day of your appointment, bring:

  • Your Passport (or DNI, if you have one) and your TIE/NIE card. It's wise to bring originals and a copy of each, just in case
  • The Application Code you received by email (print the email or note)

When you arrive, let them know you're there to certify identity for an FNMT certificate. They will likely have you show your documents, and you may need to confirm some details (address, etc.). The official will enter your info in their system and validate your request. The process is usually quick – often just a few minutes to check your ID against your application. Once done, your digital certificate is authorized for issuance.

4Download and Install Your Certificate

Shortly after your identity is verified (often within the same day, sometimes within an hour or so), you can download your certificate from the FNMT website.

  • Return to the FNMT portal's Descargar Certificado (Download Certificate) section
  • Input your NIE/DNI, your surname, and the application code from before
  • Be sure you're doing this on the same computer/browser where you made the initial request, because the certificate will be installed directly into that browser's storage
  • The FNMT configurator will launch again and ask for the password you created in Step 2 to unlock the certificate file
  • Enter that password, and then the system will finalize the installation

You should see a confirmation that the certificate was installed. The certificate now resides in your browser or operating system certificate store.

During the download, you'll usually be given the option to make a backup (it might ask "¿Desea hacer una copia de seguridad?" – say Sí if prompted). If you accept, it will let you save a backup file (a .PFX or .P12 file) with a password.

Always back up your certificate either during this step or immediately after installation!

This backup file is critical – it allows you to import the certificate on other browsers or devices, and it's your safety net if your computer ever crashes. Store the backup file in a safe place (and remember the backup password).

3. Using Cl@ve as an Alternative

If you prefer not to use a digital certificate, Spain's Cl@ve system offers another secure way to access e-government services. Cl@ve is essentially a government-run single sign-on platform for citizens, allowing you to log in with a username, password, and/or one-time code instead of a browser certificate.

It's very useful for doing things on a smartphone or on public computers where you might not have your certificate installed. For this reason, we recommend getting both a digital certificate and a Cl@ve account. If you've already gotten your digital certificate, then registering for Cl@ve is quick and easy.

How to Register for Cl@ve

Before you can use Cl@ve PIN or Permanente, you must register for the Cl@ve system and verify your identity. There are a few ways to do this:

Online with an Invitation Letter (Basic Level)

If you don't have a digital certificate or don't want to go in person, you can request an invitation letter (Carta de Invitación) online:

  • Go to the Cl@ve registration portal and choose to register without certificate, by mail
  • Provide your NIE/DNI and some ID details (like ID expiration date or support number)
  • The system will send a letter via postal mail to your registered address (your domicilio fiscal on file with the Tax Agency)
  • This letter contains a Secure Verification Code (CSV) needed to complete registration
  • When the letter arrives (it can take a week or two), follow the instructions on it: go back to the Cl@ve site and finish the registration by entering the code (CSV) from the letter to confirm your identity

Note: Registering via letter gives you Basic Cl@ve registration, which allows use of Cl@ve PIN for most services. However, some higher-security services (and Cl@ve Permanente activation) require Advanced level.

In Person at a Registration Office (Advanced Level)

This is a quicker way – you can go to a Cl@ve registration office and sign up on the spot:

  • Offices that register Cl@ve include Agencia Tributaria offices, Social Security offices (TGSS), certain police stations or government offices – anywhere with a "Registro Cl@ve" service
  • No appointment is usually needed just to register for Cl@ve (though it may depend on the office)
  • Bring your passport and NIE/TIE card
  • The staff will enter your details and phone number into the system and give you an activation code (sometimes on a printout or it might display on screen/PDF)
  • This activation code is used to set up your Cl@ve Permanente password

Once registered in person, you achieve Advanced level, meaning you have full access to all Cl@ve services. You should receive a welcome SMS as well right after registering.

Online with a Digital Certificate (Advanced Level)

If you already managed to get a digital certificate first, you can actually use it to register for Cl@ve entirely online:

  • The Cl@ve registration page has an option to register with a certificate
  • You log in with your digital certificate and then provide a phone number
  • You'll get the activation code for Cl@ve Permanente

This also gives Advanced level without going in person. This method is convenient if you ended up obtaining a certificate first.

After registration, no matter which method, you'll have an account in the Cl@ve system. If you registered online by letter (basic level), you can use Cl@ve PIN immediately for most tax and administrative tasks. If you registered in person or with a certificate (advanced level), you can use Cl@ve PIN right away and also set up Cl@ve Permanente.

In fact, upon completing registration, the system shows or sends you an activation code for Cl@ve Permanente. To activate your permanent Cl@ve, go to the Cl@ve website (or use the activation link in the PDF/printout) and enter your DNI/NIE and the activation code; you'll then be prompted to choose a password for your Cl@ve Permanente account.

When to use Cl@ve

Cl@ve is especially handy if you frequently use your mobile phone or tablet for these services. The Spanish government provides a Cl@ve app (for Android and iOS) that can receive PIN codes and even scan QR codes for login (called "Cl@ve Móvil").

For example, when you choose to log in via Cl@ve on a website, a QR code may appear on the screen; you can simply scan it with the Cl@ve app and confirm on your phone, instead of typing any codes.

Additionally, if you use multiple devices (home laptop, work computer, phone), Cl@ve saves you from installing your certificate everywhere – you just need your phone to get the login code.

4. Linking to Agencia Tributaria for Tax Filings

One of the most common uses of your digital certificate or Cl@ve will be to access the Agencia Tributaria online – this is the Spanish Tax Agency's e-Office, where you file income taxes (Renta), VAT, etc., and consult tax information.

Once you have your certificate installed or your Cl@ve set up, you should test that you can log in to these services successfully before you actually need to file a return, to avoid last-minute issues.

How to log in with the Digital Certificate

  1. Go to the Agencia Tributaria portal and find a service that requires identification – for example, "Mi Área Personal" (My Personal Area) or the annual tax filing section
  2. When you click on an option like "Access with certificate or DNIe," your browser will pop up a prompt showing the certificates available
  3. Select the certificate with your name (the one you just obtained)
  4. Upon selecting it and clicking OK, the browser will use it to authenticate
  5. If everything is in order, the page will load your personal data or the service you requested

For instance, after logging in, you might see your name or NIE in the corner indicating you're identified. The Tax Agency explicitly states that these areas can be accessed with an electronic certificate or Cl@ve PIN.

How to log in with Cl@ve

  1. On the Tax Agency site (or any official service site), choose the "Cl@ve" option when prompted for login
  2. The site will redirect you to the Cl@ve authentication page
  3. Here, by default it may show the Cl@ve PIN method (often labeled "Cl@ve Móvil (incluye Cl@ve PIN)")
  4. You will be asked to enter your DNI or NIE and its expiry date or support number (to verify identity) if using PIN, or your DNI/NIE and Cl@ve password if using Permanente
  5. For Cl@ve PIN: enter your NIE and the requested data, then choose a 4-digit PIN
  6. You should receive an SMS with a 3-digit security code on your phone
  7. Enter the code and hit authenticate
  8. If done via the Cl@ve app, alternatively you might scan a QR or just receive a push notification to confirm

Once confirmed, the site will log you in and return you to the Agencia Tributaria page as a logged-in user.

Troubleshooting Login Issues

If the certificate login does not work:

  • Ensure that the certificate is correctly installed in your browser
  • If you get an error like "certificate revoked or not recognized," double-check that you used the right certificate
  • Try using a different browser

If Cl@ve login doesn't work:

  • If you get an error that your NIE/DNI isn't recognized, you might not have completed registration
  • If the SMS never arrives, check that the phone number you gave during registration is correct and active
  • Sometimes, the system might say "Nivel Básico" insufficient for a certain service. This means the service requires Advanced level Cl@ve

Once you can log in, you can file your Declaración de la Renta (annual income tax) online. The Renta web portal will accept certificate or Cl@ve logins. For example, to file, you'd go to "Renta WEB" and it will ask you to identify – choose certificate or Cl@ve as you prefer.

After logging in, you can retrieve your tax data, fill forms, and submit them entirely online. You can also check any tax notifications you have in the Tax Agency's system – in "Mis notificaciones" – which requires login as well. Having your digital ID set up means no need to visit the tax office just to get forms or information; it's all accessible on your screen.

5. Security Tips for Your Digital Certificate and Cl@ve

Using a digital certificate or Cl@ve provides strong security by design (they use encryption and personal verification), but you as the user must also take precautions to keep your credentials safe.

Back Up Your Certificate

Always keep a backup copy of your certificate file in a secure location (for example, on an encrypted USB drive). If your computer dies or you accidentally delete the certificate, the backup is the only way to recover it without re-doing the application.

Protect this backup with a strong password and do not store it in an easily guessable location on your computer. Consider making two backups (stored separately) in case one is lost.

Never Share Your Credentials

Treat your digital certificate file and passwords like you would treat your passport or bank PIN. Do not email your .pfx certificate file to anyone, and don't let others copy it. If someone obtains your certificate and its password, they could impersonate you online.

The same goes for your Cl@ve Permanente password – never disclose it. The Spanish government or banks will never ask you for the actual certificate file or your Cl@ve password; if you receive a request (phishing email, etc.), refuse it.

Use Strong, Unique Passwords

When setting the PIN/password during certificate request, choose a complex one that others can't guess. For Cl@ve Permanente, use a strong password that you don't reuse elsewhere.

Although Cl@ve uses SMS 2FA, a strong password adds another layer of security. Remember, anyone who guesses your Cl@ve Permanente password would also need your phone to complete login – but you should still make it as hard as possible to guess.

Keep Your Email and Phone Secure

The certificate process and Cl@ve rely on your email and phone. The certificate application code is sent via email – if someone has access to your email, they might see it (though they'd still need your ID to misuse it).

Likewise, Cl@ve PIN codes are sent to your phone. Secure your email with a good password and 2FA, and keep your phone locked. If your phone number changes, update it with Cl@ve promptly to prevent codes from going to the wrong person.

Be Mindful on Public Computers

If you must use a public or shared computer, prefer using Cl@ve PIN rather than importing your certificate. Cl@ve PIN leaves no certificate behind – once you log out, the code expires.

In contrast, installing your certificate on someone else's machine could risk its security (you might forget to delete it, etc.). If you do use your certificate on a shared PC, remove it from the browser immediately after or use a private browsing container if possible.

6. Get It Before Your First Tax Filing (Why It's Recommended)

While obtaining a Certificado Digital or Cl@ve is not legally required to live in Spain or even to file taxes (on paper), it is highly recommended to get it set up early, ideally before your first tax filing or any major administrative procedure. Having your digital access ready in advance will make all future processes smoother.

Think of it as setting up an "admin toolkit" for Spain. Once you have it, you'll likely use it frequently: expats report that almost all levels of government paperwork can be done online with a digital certificate or Cl@ve – from national tax declarations to regional health appointments to local town hall registrations.

It saves you from countless trips to offices and lets you handle tasks on your own schedule. For example, if you realize you need a certain certificate or need to update your address with authorities, you can often do it online in minutes with your digital ID, whereas doing it in person might have taken days or weeks of appointments and travel.

Things You Can Do Online with Digital ID

  • File an income tax return

    Submit your declaración de la renta by end of June – with a digital certificate or Cl@ve, you can do it online and even get an automatic draft from the tax authority.

  • Check your social security enrollment

    Make an appointment at INSS or check your contribution history – can be done online with certificate/Cl@ve.

  • Register as self-employed (autónomo)

    Consult work life reports or handle autónomo registration – needs certificate/Cl@ve on Seguridad Social's site.

  • Consult or pay a traffic fine

    Get a copy of your driving points report or pay fines – doable online with these IDs.

Having your digital certificate or Cl@ve from the get-go means you can handle all these from your home, which is invaluable if you're still learning Spanish or adapting to local systems. It essentially empowers you to be self-sufficient with administrative tasks.

Bottom line: Get your Certificado Digital or register for Cl@ve as one of your early "settling in" tasks. It might take a bit of effort for the initial setup, but once it's done, you'll reap the benefits throughout your stay in Spain. Future you will thank you when you effortlessly file your taxes or download a needed document with a few clicks, instead of scrambling to get credentials at the last minute.

Want to stay up to date?

Subscribe to our newsletter for Spanish tax tips, updates, and more.