What is the difference between Cl@ve PIN, Cl@ve Permanente and Cl@ve Móvil?

What it is

All three sit on top of the same system. The Cl@ve page (opens in a new tab) says you need a credential first, and that after you register and activate the access keys you can use Cl@ve in electronic administration services that are integrated with it. It also says one method may be unavailable when a service needs a higher security level than that method can provide. What the system is, including that limit, is What is Cl@ve?.

Cl@ve PIN (opens in a new tab) is a way to do procedures on the internet with a validity limited in time, which you can renew each time you need it. It is based on a code chosen by the user and a PIN sent to the phone by the Cl@ve PIN app or by SMS. The page says prior registration is obligatory. It says you do not have to remember a permanent password, and that the limited validity makes it safer.

Cl@ve Permanente (opens in a new tab) is an authentication system for people who need to access the administration's electronic services frequently. It uses a user code, your DNI or NIE, and a password that is set during activation and that only you should know. For electronic administration services that need a high security level, the system adds a one-time numeric code (an OTP) sent by SMS to your phone. The main Cl@ve page describes the same password as lasting but not unlimited, aimed at habitual access and at cloud signature, and reinforced with a one-time SMS key for some higher-level services.

Cl@ve Móvil (opens in a new tab) is the access system that lets you authenticate in the procedure you are doing. The page recommends having the APP Cl@ve installed. It lets you scan a QR so you do not have to type a user, and, if you cannot use the app, it offers a PIN sent by SMS during authentication. You still have to be registered in Cl@ve. The page says you do not have to remember any password: you confirm the request with a click, by scanning a QR, by pressing the notice that arrives on the phone (a push notification), or by opening the app, and you are then sent back to the procedure.

The app page (opens in a new tab) says the Cl@ve app puts two things in one place: identifying yourself to authenticate in a procedure, through Cl@ve Móvil, and making electronic signatures in dealings with public administrations. Using the app's services requires registration in Cl@ve. The page says the app is on Google Play for Android and on the Apple Store for iOS, and that installation needs Android 8 or later and iOS 15 or later. A person already registered who downloads the app for the first time can activate it with an activation code sent by SMS, with an electronic certificate, or with DNIe.

The practical difference is what you are asked to produce. PIN asks for a chosen code plus a short-lived PIN and does not ask you to keep a permanent password. Permanente asks for the DNI or NIE and the password set at activation, and adds an SMS code when the service needs a higher level. Móvil asks you to confirm a request in the app, with an SMS PIN only as the fallback the Móvil page describes. The registration page (opens in a new tab) still comes first: it says registration is required, and it groups the ways to register into a basic level and an advanced level.

What is different in Euskadi

These three names are Cl@ve's own. They are not three Basque tax logins. The Bizkaia identification page (opens in a new tab) and the Álava access page (opens in a new tab) describe Bak, BakQ and certificates, and they do not use the names Cl@ve PIN, Cl@ve Permanente or Cl@ve Móvil. The ZergaBidea login page (opens in a new tab) names clave operativa, BakQ and a digital certificate, and it does not use those three Cl@ve names either. Social Security is separate: the magazine's alta guide (opens in a new tab) says you identify in Import@ss with Cl@ve, a digital certificate, or any valid method, without naming PIN, Permanente or Móvil as three different altas. Which tool a Basque tax office lists is the subject of Which digital ID should I get first?.

Where to read the steps

Registering and activating Cl@ve, including the app, is Get Cl@ve. The apps page, which points at Cl@ve and at Import@ss, is Apps. This answer stops at the difference.