Which digital ID should I get first?
The next office decides which digital ID you need. Import@ss, for Social Security, is described as accepting Cl@ve, a digital certificate, or any valid method. The Bizkaia and Álava identification pages name Bak, BakQ and certificates, and they do not name Cl@ve. There is no single ID that those pages all list. This is a choice between the IDs those pages describe, not the request steps.
What it is
Three different issuers describe three different tools.
Cl@ve (opens in a new tab) is the shared system for electronic access to public services: agreed keys (a user plus a password), complementing the electronic DNI and an electronic certificate. The same page says a service integrated with Cl@ve may not offer every method when it needs a higher security level. What the three Cl@ve names mean is in Cl@ve PIN, Permanente or Móvil. The definition is in What is Cl@ve?.
BakQ (opens in a new tab), on Izenpe's own page, is a means of identification and electronic signature for people over 16. The page describes an identifier and the means of authentication: the user (DNI or NIE), a password, and a code sent by SMS. A qualified certificate in a central repository is used for signature acts. Izenpe says it works on computers, phones and tablets, on any operating system, with nothing to install. Asking for a BakQ also issues Bak. The two share the password, the contact details and the period of validity. Izenpe says Basque administrations have electronic offices where you identify yourself, and that they show the Euskadi identification portal, where you choose among the means they offer. If you choose BakQ, it asks for the password and the coordinates.
The FNMT page for the natural-person software certificate (opens in a new tab) describes a downloadable user certificate. The page divides obtaining it into steps that have to be done in order: prior configuration, an internet request that ends with a request code sent to your email, accreditation of identity at an accreditation office, and download about one hour after that accreditation, using the request code. The page says that at AEAT offices, Social Security offices and other offices an appointment is required, and that you should check with the office. That sentence is about the FNMT's own certificate. It is not a rule of a Hacienda Foral.
Which one comes first is whichever the next procedure's own page asks for. If that procedure is the Social Security alta, the magazine guide (opens in a new tab) says the first step in the Import@ss app is to identify yourself with Cl@ve, a digital certificate, or any valid method. If that procedure is a tax office in Bizkaia or Álava, use the methods those offices list below. The alta itself is Register with Social Security. The tax registration is Register with your Hacienda.
What is different in Euskadi
The state Cl@ve system and the Basque identification pages are not the same list.
Araba / Álava
The access page (opens in a new tab) says the electronic office is used with BAK, BAKQ or a digital certificate. BAK is a user and a password for procedures that need basic confidentiality, and the page's example is confirmation of proposed IRPF drafts (Rentafácil at the Hacienda Foral de Álava). BAKQ is BAK plus coordinates, described as a cloud certificate of greater legal standing, with electronic signature, and the page says it can now be obtained remotely by video identification. Admitted certificates are those on the TSL. The page names the electronic DNI and FNMT. It does not name Cl@ve.
Bizkaia
The identification page (opens in a new tab) says each procedure sets one or more means of identification, which you can see in the catalogue of procedures. The means it then presents are Bak (free, natural persons, requested on the internet, activation code to the tax domicile, password to the phone), BakQ (free, natural persons, in person or with an electronic certificate or by video identification, Bak plus a one-time SMS or a coordinate card), electronic certificates (paid, in person, natural and legal persons), the citizen certificate (paid, natural persons, appointment or DNIe, extra software and a card reader) and DNIe (natural persons, in person, extra software and a card reader). It does not name Cl@ve.
Gipuzkoa
ZergaBidea (opens in a new tab) says each user has a private virtual desk and needs identification to open it. Its login page (opens in a new tab) names clave operativa, BakQ and a digital certificate, and it does not name Cl@ve. Clave operativa is an identification number and two numeric keys, handed over in person in a sealed envelope. Follow Your Hacienda Foral and Donostia for the Gipuzkoa procedure.
Where to read the steps
The request for each ID is a guide page, not this answer. Cl@ve: Get Cl@ve. BakQ: Get BakQ. The FNMT certificate: Get an FNMT certificate. The apps that use them: Apps. Social Security registration, where the magazine says you sign in with Cl@ve or a certificate: Register with Social Security. The Hacienda registration: Register with your Hacienda.
Free, independent information. Not an official government website or a gestoría. General information, not legal, immigration or tax advice. Confirm current requirements with the authority before you act.
Official sources
- Cl@ve: what it is (opens in a new tab)
- Izenpe: BakQ (opens in a new tab)
- FNMT: natural-person software certificate (opens in a new tab)
- Social Security magazine: registering as a self-employed worker (opens in a new tab)
- Álava electronic office: how to access (opens in a new tab)
- Bizkaia: identification methods (opens in a new tab)
- Gipuzkoa: ZergaBidea (opens in a new tab)
- Gipuzkoa: ZergaBidea login (opens in a new tab)