What is Cl@ve?
Cl@ve is a shared system for electronic access to public services. You identify yourself with a user and a password, and it complements the electronic DNI and an electronic certificate. A service that uses Cl@ve may still leave one method out when it needs a higher security level. After you register, the names on the Cl@ve site are PIN, Permanente and Móvil.
What it is
The Cl@ve "what is it" page (opens in a new tab) says Cl@ve is meant to unify and simplify citizens' electronic access to public services. Its main aim is that a person can identify themselves to the administration with agreed keys (a user plus a password), without having to remember different keys for each service. It complements the current ways of getting in with the electronic DNI and an electronic certificate, and it offers signature in the cloud with personal certificates kept on remote servers.
The same page says you can get in by scanning a QR, confirming an authentication request, or with a permanent password, and that you need a credential first. Cl@ve Móvil identifies you without a password, by a QR or a request on your phone. Cl@ve Permanente is for habitual access and cloud signature, with a password that lasts but is not unlimited. Cl@ve PIN (opens in a new tab) is a code with limited validity. The comparison is Cl@ve PIN, Permanente or Móvil.
The registration page (opens in a new tab) says you must register before you can use Cl@ve. It groups the ways to register into a basic level and an advanced level, according to the security required. Under the basic heading it lists internet registration with automatic video identification, and internet registration with an invitation letter. Under the advanced heading it lists internet registration after a manual review of that automatic video identification, internet registration with an electronic certificate or DNIe, and registration in person at a registration office. This page does not walk those steps. The guide does, on Get Cl@ve. The same page says that, once the keys are active, you can use Cl@ve only in services integrated with the system.
What is different in Euskadi
Cl@ve is a state system. Whether a Basque office lists it is a separate question, and the three Diputaciones publish their own identification pages. Social Security is not one of those tax offices. The Social Security magazine's alta guide (opens in a new tab) says you identify in the Import@ss app with Cl@ve, a digital certificate, or any valid method. That is a Social Security fact, not a Hacienda Foral fact.
Araba / Álava
The Álava electronic office access page (opens in a new tab) says you identify with BAK, BAKQ or a digital certificate. BAK is a user and a password, for procedures that need a basic level of confidentiality, and the page gives the electronic confirmation of proposed IRPF drafts as an example (Rentafácil, for the Hacienda Foral de Álava). BAKQ is described as BAK plus an extra security element, the coordinates, and as a cloud certificate with electronic signature. The page says it can now be obtained remotely with video identification. Digital certificates admitted are those on the trusted list (TSL), and the page names the electronic DNI and FNMT as examples. That page does not name Cl@ve.
Bizkaia
The Bizkaia identification page (opens in a new tab) lists Bak, BakQ, electronic certificates, the citizen certificate and DNIe. Bak is free, for natural persons, requested on the internet: an activation code arrives at the tax domicile, and the password then arrives on the phone. BakQ is free, for natural persons, and requires attending in person, using an electronic certificate, or video identification. The page calls BakQ "Bak with an added security means", a one-time SMS code or a coordinate card. Electronic certificates are paid and in person, for natural and legal persons. The citizen certificate and DNIe are for natural persons and need extra software and a card reader. That page does not name Cl@ve.
Gipuzkoa
ZergaBidea (opens in a new tab), the Diputación Foral de Gipuzkoa cloud service for tax obligations, says each user has a private desk and needs identification to open it. Its login page (opens in a new tab) names clave operativa, BakQ and a digital certificate. Clave operativa is an identification number and two numeric keys, handed over in person in a sealed envelope. BakQ is named there as an electronic signature valid for any procedure in ZergaBidea. That page does not name Cl@ve. The procedures are on Your Hacienda Foral. Donostia is on the Donostia page.
Where to read the steps
Getting Cl@ve is a procedure. It stays on Get Cl@ve. BakQ, which the Bizkaia and Álava pages name and which Cl@ve's own page does not replace, is on Get BakQ. The natural-person software certificate from the FNMT, which Álava's access page names as an example of an admitted certificate, is on Get an FNMT certificate. The apps, including Cl@ve and Import@ss, are on Apps.
Which of those to open first is a different question: Which digital ID should I get first?. The three Cl@ve names are compared in Cl@ve PIN, Permanente or Móvil.
Free, independent information. Not an official government website or a gestoría. General information, not legal, immigration or tax advice. Confirm current requirements with the authority before you act.
Official sources
- Cl@ve: what it is (opens in a new tab)
- Cl@ve: how you can register (opens in a new tab)
- Cl@ve PIN: what it is (opens in a new tab)
- Social Security magazine: registering as a self-employed worker (opens in a new tab)
- Álava electronic office: how to access (opens in a new tab)
- Bizkaia: identification methods (opens in a new tab)
- Gipuzkoa: ZergaBidea (opens in a new tab)
- Gipuzkoa: ZergaBidea login (opens in a new tab)