Cl@ve and the Digital Certificate in Spain: A Guide for Americans

Spain’s online administration, from the tax return to an immigration renewal, rests on two keys: Cl@ve, the government’s shared login, and the digital certificate issued by the FNMT, the national mint. For an American arriving on a visa, the certificate can come first. It can sometimes start from the NIE assignment paper, which gives the foreigner identification number, even at a Spanish consulate in the United States, whereas Cl@ve opens to foreigners only once they hold a TIE, the foreigner identity card; how to get a TIE card covers that step. This article is for informational purposes only and is not legal advice; verify current requirements with the relevant Spanish authority or a licensed professional.

What goes wrong if your Cl@ve or digital certificate is missing or misused?

Without Cl@ve or a digital certificate you cannot open the state’s notification inbox (citizen portal) or file immigration papers on Mercurio, and one phone number serves one person: the AEAT cuts off the earlier DNI (Spanish ID card) or NIE when someone reuses the number.

The AEAT, Spain’s tax agency, also bars anyone else from using your credentials, consent or not (AEAT). Unless a specific rule obliges you, Law 39/2015 leaves paper open. A missing digital ID nonetheless has consequences in two places.

• Notices you never open. Once electronic notification is mandatory for you or your own choice, a notice left unopened for 10 calendar days counts as rejected (article 43), and that remains true even if the email or SMS alert never arrived (article 41).
• Filing online. Mercurio, the immigration e-filing platform, expects a recognized digital certificate (Mercurio page). In Barcelona, a note of May 20, 2025 routed non-lucrative and self-employed renewals through Mercurio only; the Supreme Court has since annulled the online only rule for non-lucrative renewals (BOE; see non-lucrative visa renewals), and no page read says whether Barcelona now accepts paper.

What are Cl@ve, Cl@ve PIN and the FNMT digital certificate?

Cl@ve is Spain’s shared government login: the Cl@ve app replaced the Cl@ve PIN app and keeps a PIN by SMS as a fallback, while the FNMT certificate is a file installed on your computer, free for any adult with a DNI or NIE.

The 2015 rules distinguish two levels of registration: básico (basic), reached through the online letter, and avanzado (advanced), reached in person or with a certificate. AEAT pages call the higher level alto (high). According to the AEAT, certain procedures of other bodies require the advanced level, though it says nothing of the kind about its own, and Social Security notifications by Cl@ve require it as well (Seguridad Social).

On three details the official pages give different figures, and the stricter one is the safer basis.

How do you register for Cl@ve as a foreigner?

A foreigner registers for Cl@ve by an invitation letter, requested with the NIE and the TIE’s support number and mailed in about 7 working days, in person at a registration office, or online with a digital certificate; video registration is temporarily for Spaniards only.

Wait for the TIE. The 2015 resolution opens Cl@ve to Spaniards with a DNI and to foreigners with a TIE or EU citizen certificate in force, and the online forms check the card’s número de soporte (support number), which on a TIE is the letter E and 8 digits on the front (AEAT); Madrid’s city offices likewise refuse documents without one. Of the four documents the AEAT lists as carrying it, none is a visa or the NIE paper. When correctly typed data keep being rejected, the AEAT refers the applicant to a Policía Nacional station (AEAT); no page addresses a renewed TIE that brings a new support number.

Social Security runs its own video identification, which accepts a TIE, yet the Import@ss help presents it as a login for Import@ss, Social Security’s online portal, rather than a Cl@ve registration. That leaves a TIE holder three routes:

1. Invitation letter, basic level. The request is made online or in the Cl@ve app (Cl@ve). The letter goes only to the domicilio fiscal, the tax address on the AEAT census, and must be used within 60 days (AEAT). An outdated address is corrected through Renta WEB (the AEAT’s online tax return service), census form 030 or an AEAT office (AEAT). No page says whether the letter can go to a U.S. address, or whether a new NIE carries a tax address at all.
2. In person, advanced level. Offices of the AEAT, Social Security, SEPE (the employment service), the government delegations and many regional and local governments register applicants, many by appointment (Cl@ve), and so do 22 provincial and 5 local DGT traffic offices, none of them in Barcelona or Valencia (DGT); the AEAT takes bookings online or on 91 333 5 333 (AEAT).
3. With a certificate, advanced level. Holding an FNMT certificate allows registration online (Cl@ve).

The documents requested at the counter vary from page to page. The Cl@ve office page mentions only the DNI; the AEAT asks for the DNI or NIE document plus a passport for foreigners; the citizen portal, like Madrid, names a TIE, residence permit or EU certificate plus a passport. Bring the TIE, the passport and the phone. A U.S. number is accepted if it receives SMS from foreign operators (Cl@ve FAQ) and is given with its country code (AEAT). No consulate appears on the office list.

How do you get the FNMT digital certificate, in Spain or from the U.S.?

The FNMT digital certificate is free for any adult with a DNI or NIE: a foreigner requests it online, proves identity in person at one of over 2,400 offices in Spain or at a Spanish consulate abroad, then downloads it.

Video identification, at 2.99 euros plus tax, requires an electronic DNI (FNMT), and the app’s video route a valid DNI for now (FNMT app); for an American, the identity check therefore happens in person.

1. Prepare. The FNMT configuration tool runs first, and every later step has to happen on the same computer and user account (FNMT).
2. Request. The request produces a code; the password chosen at this stage is needed for the download and cannot be recovered (FNMT).
3. Prove your identity in person, by appointment at many offices in Spain (FNMT). Someone appearing in your place needs your signature certified by a notary or a Spanish consulate, and a foreign notary’s certification must carry an apostille or legalization, with a sworn Spanish translation of the apostille (FNMT rulebook).
4. Download. The timing differs by source: immediately on one FNMT page, about 1 hour later on another, and one or two business days later according to the consulates.

For a foreigner, the FNMT’s identity page lists two documents, each with the passport: the foreigner card showing the NIE, whatever its validity date, or the official document granting the NIF or NIE (the NIE assignment paper); a passport alone is not on the list. The FNMT’s rulebook of March 2, 2026 limits the NIE paper to special cases, a person who has never held a foreigner’s card and is obtaining the NIE, or who obtained it for administrative, economic, professional or social reasons; the identity page sets no such limit.

According to their pages in Spanish, the Washington, New York, Los Angeles and Miami consulates check identity free and without an appointment, on weekdays from 9 a.m. to 1 p.m. They accept a TIE, or a verifiable NIE document with a valid ID; their checklists leave out the passport, which the FNMT itself requires, so it belongs in the folder regardless. An AEAT list dated June 7, 2021 also names the consulates in Boston, Chicago, Houston, San Francisco and San Juan, Puerto Rico.

Validity depends on the hierarchy behind the certificate. The FNMT’s practice statement of November 11, 2025 limits certificates of its new G2 hierarchy to 4 years and runs those of the older RSA hierarchy to December 31, 2028 at most. An FNMT notice of December 9, 2025 sets the end of RSA issuance at December 31, 2026, while an AEAT page of January 8, 2025 still assigns every certificate 4 years, a term an RSA certificate issued today cannot reach. Since no page says which hierarchy is issued today, the expiry date shown on the certificate is the one to rely on. Renewal opens 60 days before expiry and can be done online only once (FNMT). Autofirma supports the G2 hierarchy’s elliptic-curve certificates from version 1.9, the FNMT says.

Which procedures need Cl@ve or a digital certificate?

The basic Cl@ve level, reached by letter, opens many Spanish online services but not all of them, and not Cl@ve Firma, while the AEAT accepts Cl@ve for income and wealth tax returns (AEAT).

• Tax return. Renta WEB accepts Cl@ve (AEAT) and also works with a 6-character reference (AEAT). That reference currently comes from box 505 of the 2024 return or, for someone who did not file, the last five IBAN digits of an account held in 2025. NIE holders add the support number, and each new reference, up to 10 a day, cancels the previous one (AEAT).
• Social Security. Import@ss accepts an SMS login when the Tesorería (the Social Security treasury) has your mobile on file, as well as Cl@ve or a certificate (Seguridad Social); without any of these, some procedures accept a copy of the NIE document and a selfie (Import@ss help).
• Immigration. Mercurio states that filing takes a digital certificate (Mercurio). Access for individuals runs through the Cl@ve gateway, but no official page says which logins are offered there, so a certificate is the reliable basis for filing online. The e-office’s Mis expedientes (my files) area, by contrast, accepts Cl@ve (e-office). The UGE, the unit that handles Law 14/2013 permits, requires a certificate, even though its procedure page displays a Cl@ve icon.
• Nationality. The application button refers to online processing with a digital certificate and requires Autofirma (Justice e-office); the ministry’s guide of November 5, 2025 asks the applicant to choose a Cl@ve login method but stops before the signing step. A certificate is the safer assumption for online filing, as in Spanish citizenship by residence, which also covers filing on paper (Law 39/2015, article 16.4).
• Traffic. miDGT, the app of the DGT (Spain’s traffic authority), accepts a certificate, Cl@ve, or personal data plus an SMS key sent to a phone the DGT has on file (DGT).
• Padrón. Madrid’s online route requires electronic identification (Madrid); Barcelona’s requires a signature by idCAT Mòbil, Cl@ve, DNIe or FNMT certificate (Barcelona). How to register on the padrón covers the documents.

Who must use electronic notifications, and who can act for you?

In Spain, self-employed workers must deal with Social Security electronically, notifications included (Seguridad Social), as must companies; someone else can act for you through a registered power or, for tax filings, a gestor’s colaboración social, but nobody can register for Cl@ve through a representative (Cl@ve).

Notifications reach the citizen through two state channels: the DEHú (Dirección Electrónica Habilitada única), the state’s notification inbox, and Mi Carpeta Ciudadana, the state’s personal online folder. Both require a certificate or Cl@ve, and a person not obliged to use them may move between paper and electronic notification at any time (citizen portal). The Carpeta lists pending notifications; its FAQ says they are opened in the DEHú, while the citizen portal and Social Security say the Carpeta can open them itself. The DEHú can send alerts by email (Carpeta).

Article 14.2 of Law 39/2015 imposes electronic dealings on companies and other legal persons, entities without legal personality and members of compulsory professional bodies acting as such, among others. For the self-employed, the Social Security duty has applied since October 1, 2018, with no postal warning (Seguridad Social); registering as autónomo in Spain covers the Social Security registration that triggers it. Mandatory AEAT electronic notifications, which count as served after 10 unopened calendar days (AEAT), apply to companies and members of certain registers under Royal Decree 1363/2010, not to ordinary self-employed individuals; the AEAT announces an inclusion on paper and on its e-office.

• General register. A power recorded in the REA lasts 5 years at most, and the attorney, for instance a gestor (a professional who handles administrative filings), must accept it.
• Tax agency. Gestores file through colaboración social, the AEAT’s agreements that let professionals file for clients, using their own certificate, which does not extend to receiving AEAT communications. Anyone else acting for you needs a power in the AEAT’s register (AEAT FAQ), granted online, at an AEAT office or by notarized document (AEAT), for 5 years at most (AEAT).
• Social Security. Import@ss lets a third party be authorized for its public services, but not for your personal area (Import@ss help).

How do you keep Cl@ve safe, and what are idCAT and ACCV?

No Spanish administration asks for Cl@ve codes by phone, email or SMS, and the AEAT warns never to confirm a Cl@ve Móvil request started from a private website; changing the registered phone takes a certificate or an office visit (AEAT).

On Renta WEB, the first login page should start with https://www2.agenciatributaria.gob.es and the Cl@ve Móvil page with https://www12.agenciatributaria.gob.es (AEAT). INCIBE, the national cybersecurity institute, warned of texts spoofing the AEAT sender name on May 26, 2026 and of fake DEHú logins on February 3, 2026.

If you lose the phone, deactivate the app’s device and log in with a 6-digit SMS code (AEAT). A lost FNMT certificate is revoked in person, or at any hour by phone with the request code (FNMT).

Catalonia and the Valencian Community issue their own digital IDs.

• idCAT Mòbil is free from age 16 (Generalitat) and is obtained through the routes shown in the table (Generalitat). The stronger idCAT Mòbil + by video requires a DNI (Generalitat).
• idCAT Certificat, available from 18 with an NIE, is issued by video with a DNI or TIE according to the Generalitat’s page, although its section for foreigners says in person only.
• ACCV, the Valencian certification authority, issues a 3-year citizen certificate from age 14 with an NIE (ACCV), and its video ID accepts a TIE. Both pages price video ID at 0 euros, yet one says it has a cost and the other mentions a payment step.

Your next step: an appointment the week your TIE arrives

Holders of an NIE assignment paper may obtain the FNMT certificate before moving, at the Spanish consulate in Washington, New York, Los Angeles or Miami; once the TIE arrives, that certificate registers them for Cl@ve at the advanced level.

For everyone else, and although no official page ranks one ID above the other, the sensible sequence is an advanced Cl@ve registration at an AEAT office booked for the week the TIE arrives, followed by the FNMT certificate at an office in Spain, since Mercurio expects one and the nationality button names one, even though its guide starts from Cl@ve. Paper filing remains possible for nationality.

Most readers can manage all of this alone. Outside help makes sense when a renewal has to be filed online against a deadline, or when a gestor must act for you, in which case a registered power is the proper instrument, never your credentials. How to get an NIE number explains the number each step asks for.

The Spain Navigator puts every step of your move to Spain in order, from the visa to settling in.