What they are and how they differ
A digital certificate (often called an "electronic signature") is a file on your computer or phone, protected by a password. It is issued by a certification authority. In Spain this is most often the Royal Mint, FNMT (Fábrica Nacional de Moneda y Timbre). The law recognises a qualified certificate as a valid way to identify yourself and sign before any administration (Ley 39/2015, arts. 9 and 10), and the administration must accept it in all procedures.
Cl@ve is a state identification system with prior registration. The official website describes it as "un sistema para identificarte electrónicamente en las relaciones con las Administraciones Públicas" (a system to identify yourself electronically in dealings with public administrations). It has several ways to log in: Cl@ve PIN (a temporary code, valid for 24 hours), Cl@ve Permanente (a permanent password), Cl@ve Móvil (through an app) and Cl@ve Firma (a signature made with a certificate). It does not replace the certificate in every case: some filings and signatures need the certificate itself.
What you need to get an FNMT certificate
The FNMT website says that a Spanish citizen or a foreigner can get the certificate free of charge if they are "mayor de edad o menor emancipado que esté en posesión de su DNI o NIE" (an adult or an emancipated minor who holds a DNI or NIE). So without a NIE you cannot get one. The steps are as follows.
Step one: set up your computer following the FNMT instructions ("Configuración previa"). Step two: fill in the online application. A request code (código de solicitud) will arrive by email. This is the moment when you choose your own password, and FNMT warns that a forgotten password cannot be recovered, so you would have to start the application again. Step three: go with the code to an identity accreditation office (oficina de acreditación de identidad). Some offices, for example those of the tax agency and the Seguridad Social, work by appointment only. Step four: about an hour after your identification, download and install the certificate, then make a backup copy straight away.
At the office a foreigner needs the request code, a passport and a document showing the NIE (a residence card or a document with the NIE number). EU citizens have their own list, shown on the FNMT website.
A visit in person is a legal requirement: identifying the applicant "exigirá su personación" (requires their physical presence), unless otherwise provided. There are exceptions: the signature on the application can be notarised, and the law provides a separate procedure for remote identification by video (Ley 6/2020, art. 7). A qualified certificate cannot be valid for more than five years (same law, art. 4). The exact term of your certificate is stated in the certificate itself.
How to get Cl@ve
You can register online or in person. The official website lists the options: online with video identification (automatic or with a manual check), by invitation letter, online with a digital certificate, or in person at a registration office. If you already have a certificate, the shortest route is through it. Check clave.gob.es before you start to see which option is available for your particular document.
What they are for in practice
You use a certificate and Cl@ve to file tax returns, request certificates and records, deal with the municipal register and traffic fines (DGT), apply for grants and sign electronic documents. In immigration procedures, receiving electronic notifications through the single address DEHú (the state notification mailbox) requires a valid certificate or Cl@ve. Electronic notification is mandatory only for those the law obliges; everyone else chooses it, for example by ticking the consent box on the official application forms. More in the article DEHú: Electronic Notifications from Spanish Authorities.
What you must not hand over to others
The certificate is personal. FNMT does not issue an individual's certificate through a representative (FNMT's answer to a frequently asked question, no. 1632) and does not recommend giving the certificate and password to third parties: the certificate is "personal e intransferible" (personal and non-transferable, answer no. 1714). When you sign with it, you are responsible for what you sign. So any service that offers to "get the certificate for you" or asks for the file and password is a reason to stop. Acceptable help is different: help with the set-up, an explanation of the steps, or preparing documents that you will sign yourself.
FAQ
Do I need a NIE to get a certificate?
Yes. FNMT issues the certificate to people who have a DNI or a NIE.
How much does an FNMT certificate cost?
The FNMT page says that getting it is free of charge.
Can I get a certificate without going to an office?
The general rule of the law requires you to attend in person. There are exceptions: notarised signature, or video identification under the procedure set by additional rules. Check the current options on the FNMT website.
Can a relative or representative get the certificate for me?
No. FNMT does not issue individuals' certificates through a representative.
What if I forget the password?
The password cannot be recovered. You need to go through the application again, including the identification.
How is Cl@ve different from a certificate?
Cl@ve is a login system with registration. A certificate is a file with your data and a signature key. Some filings need the certificate itself.
Where to start
AUTO PACK for 29€ builds a step-by-step route for your case, and Full Pro for 149€ supports the procedure in more detail. You can ask a short question on WhatsApp: +34743071481.