The digital ID options in Spain and what each one does

Terms used

• Cl@ve — Cl@ve is the Spanish government's shared online login system for public services, with several methods.
• Cl@ve PIN — Cl@ve PIN is a temporary code, valid for a short time, that you get through the Cl@ve app.
• Cl@ve Permanente — Cl@ve Permanente is a username and password, reinforced with a one-time code sent by SMS or the app.
• FNMT — The FNMT is Spain's national mint, which issues official electronic certificates.
• Certificado de Persona Física — The Certificado de Persona Física is the FNMT's personal electronic certificate, free and valid for 4 years.
• Certificado de Representante — The Certificado de Representante is an FNMT certificate for people acting on behalf of companies or entities.
• DNIe — The DNIe is the Spanish citizens' ID card with a chip that carries its own electronic certificate.
• TIE — The TIE is the foreign resident ID card.

Key rules

• TIE: Your TIE cannot act as a digital certificate, so use Cl@ve or get the FNMT certificate.
• Minimum level: Each service decides the lowest security level it accepts, so a method that works on one site may fail on another.
• Certificate validity: The FNMT personal certificate is valid for 4 years.
• Cl@ve app: Cl@ve PIN now runs through the app, and the app is changing, so check which one is current before installing.

The short answer

Spain has two families of digital ID. Cl@ve is a login system run by the government, with several ways in. The electronic certificate is a file or card that proves who you are and lets you sign documents. Many services accept both. Some accept only one.

If you hold a TIE, note that it has a chip but carries no usable electronic certificate for authentication or signing. If you need a digital certificate, get the FNMT Certificado de Persona Física or use Cl@ve instead.

Cl@ve: three ways to log in

Cl@ve PIN gives you a temporary code that is valid for a short time. You now get it through the Cl@ve app, not by SMS. The old SMS-based PIN is being phased out. Use it for one-off tasks.

Cl@ve Permanente is a username and password. For extra security, you also enter a one-time code sent by SMS or through the app. Choose it if you will use government sites often.

Cl@ve mobile (the Cl@ve app) is the newer app method. The Cl@ve PIN app is being replaced or merged into it. Before you install anything, check on the Cl@ve site which app is current, because the live methods keep changing.

The Cl@ve login page also lets you identify yourself with an electronic certificate or a DNIe (the Spanish citizens' ID card). You do not need to register separately for this.

The electronic certificate

The certificado digital is issued by the FNMT, Spain's official certificate authority. The main options are:

• Certificado de Persona Física: the standard personal certificate. It is normally installed in your browser or computer and lasts 4 years. Foreigners with a NIE can get it.
• The same certificate on a card or token: a physical version of the same thing.
• A mobile or cloud version: introduced in recent years. Check the FNMT site for what is on offer now.
• Certificado de Representante: only if you act for a company, as a sole administrator, or for an entity without legal personality. Most individuals never need it.

The DNIe carries its own certificate, so Spanish citizens do not need a separate one.

Which one will a service accept?

Each service sets its own minimum security level. A simple lookup may accept a basic Cl@ve method. A sensitive filing may ask for a stronger one. Cl@ve Permanente is generally rated at the middle ("substantial") level at best, and Cl@ve PIN can be rated lower depending on the service. The FNMT software certificate and the DNIe are accepted at the highest level. If a service rejects your Cl@ve login, that is usually why. Try the certificate.

Check the service's login page to see which methods it lists. Then pick the simplest one it accepts. The decision, documents and checklist below help you choose and prepare.

Choosing between options

Which digital ID should you use?

• Cl@ve PIN or the Cl@ve app: You need a quick, temporary login for a service that accepts Cl@ve at a lower or substantial level.

• Cl@ve Permanente: You log in often and want a username and password, reinforced with a one-time code by SMS or the app.

• FNMT Certificado de Persona Física: A service asks for the high level, or you need to sign documents. It is free, valid for 4 years, and available with a NIE.

Start with what the service accepts. If it needs the high level, use a certificate; otherwise Cl@ve is usually enough. A TIE alone cannot act as a certificate.

Check the minimum security level with the office or service you are dealing with, as each one sets its own.

Online login (Cl@ve) methods and the certificate side by side

How to choose

For most everyday tasks, such as checking a record or booking an appointment, a Cl@ve method is enough. Cl@ve Permanente or the app is the practical pick.

Get a certificate if you need to:

• sign documents with a legally binding electronic signature
• file many registry or tax forms
• act on behalf of another person or a company
• deal with the Registro Mercantil or the courts

Each service sets the lowest security level it accepts. If Cl@ve is refused, the service needs a certificate.

If you have a TIE

Your TIE has a chip but carries no usable electronic certificate. If you need a certificate, get the FNMT Certificado de Persona Física, which you can request with your NIE.

Check before you register

The old SMS-based PIN is being phased out, and the Cl@ve PIN app is being merged into the new Cl@ve app. Check on the official Cl@ve site which methods are live before you register.

Documents you need

• FNMT Certificado de Persona Física: the personal certificate issued by the FNMT, free and valid for 4 years. It is available to people with a DNI or NIE. Software version is downloaded to your computer; a card or token version also exists.

• DNIe (Spanish citizens' ID card): carries its own certificate, so you do not need a separate FNMT certificate to log in with it.

• Certificado de Representante: needed only if you act for a company, a sole administrator role or an entity without legal personality.

Checklist

• Check which login methods the service you need accepts: Cl@ve PIN, Cl@ve Permanente, the Cl@ve app, or an electronic certificate.

• Check the minimum security level the service asks for before you pick a method.

• Check on the Cl@ve site whether the Cl@ve PIN app has been replaced by the new Cl@ve app, and install the one in use.

• Set up Cl@ve Permanente if you want a username and password reinforced with a one-time code by SMS or the app.

• Get the FNMT Certificado de Persona Física if a service requires a certificate and you only have a TIE.

Frequently asked questions

Can a foreigner get the FNMT certificate?

Yes, if you have a NIE, you can get the Persona Física certificate. It is free and valid for 4 years from the date of issue.

Why does one service accept Cl@ve but another asks for a certificate?

Each service sets the minimum security level it accepts. Cl@ve is generally rated substantial at best, while the FNMT software certificate and the DNIe are accepted at the high level. If a service asks for a certificate, Cl@ve alone will not do.