Coretax Digital Certificates for Companies: Prepare Tax Signing Credentials

Assign the person and the tax document first

Name the preparer and intended signer for each tax invoice, withholding document, periodic return or annual return before requesting a certificate. This exposes a missing role while it can still be resolved, rather than leaving a completed document waiting for submission.

Coretax's corporate access model separates personal authentication from acting for a taxpayer. The DGT impersonation explanation says an authorized representative signs in through their personal account, then selects the company from the taxpayer/name dropdown. The available menus depend on the access granted. A valid signing credential does not itself grant authority to act for every company or sign every document.

For a newly formed entity, carry the company's correct legal name and Taxpayer Identification Number (NPWP) into the tax access workstream. The underlying entity records belong with the company formation process in Indonesia ; credential preparation is a separate operational task. Do not mark tax signing as complete merely because the incorporation documents have been received.

An internal signing instruction should identify the company, document category and responsible person. It does not replace authority under applicable tax rules or the role shown in Coretax. Resolve disputed signing authority before portal setup.

Build a signer-to-document control sheet

Use one row per person and document category. The suggested signer-to-document register cross-checks identity, credential and company access; it is an internal preparation tool, not a DGT application form or additional attachment requirement.

Keep working access to the person's registered contact channels and identification for their account route. Label login records carefully: an EFIN and Coretax access distinction can be lost in a general folder of tax passwords. Track account access separately from signing readiness.

For a foreign individual who needs digital access, DGT publishes a foreign-subject access route using the account activation menu. Its listed inputs include passport details, country of origin, telephone, email and required photographs. Establish the correct account route first; this access procedure does not by itself decide that person's tax residence or corporate signing authority.

Choose KO DJP or a PSrE certificate

DGT's credential explanation provides two routes: register an electronic certificate issued by a Penyelenggara Sertifikat Elektronik (PSrE), or obtain a Kode Otorisasi DJP, the DGT authorization code, when a PSrE certificate is not held. Activating an account and obtaining its signing credential are separate actions.

For the PSrE route, identify the issuer and the signer's ID used for that certificate. For the KO DJP route, the signer creates a passphrase. The DGT request instructions distinguish these inputs. Do not put a personal login password into the preparation record as though it were the requested signer ID or passphrase.

Record the credential type and holder first. Check any external issuer's enrollment, commercial terms and renewal arrangements with that issuer; no common price or turnaround is assumed. Retain status and references in the company register, with the secret kept in an appropriately protected personal credential process.

The personal credential and company-permission tracks must agree before the team treats the specified signing task as ready.

Request the credential and verify its status

Request the credential in the intended individual's account context. The DGT KO DJP procedure separates requesting it from checking usability. Read the current declaration; portal labels can change as Coretax is improved.

1. Open Portal Saya and select Permintaan Kode Otorisasi/Sertifikat Elektronik. Check that the request relates to the intended signer.
2. Select the relevant credential type. For KO DJP, create the passphrase; for a supported external certificate, use the issuer and signer details required by the form.
3. Review the information and declaration, then use the current save or submission control. Record the result without disclosing the passphrase.
4. Inspect the certificate under the profile's external-identification area and its Digital Certificate tab. Check the holder and status rather than relying on the request notification.
5. Use Periksa Status if the status is Invalid. DGT instructs users to select Menghasilkan after a successful result; if the check is unsuccessful, follow the guidance to repeat the request.
6. Retain the available receipt and issuance record. DGT's request guide identifies Dokumen Saya as the place to retrieve the issued KO DJP document after the validation sequence.

Record Valid status , the check date and the certificate entry inspected. If the holder's identity does not match the intended signer, pause rather than treating the output as completed evidence.

Finish preparation before the first real signing task. No fixed issuance duration is assumed: account access, identity corrections and unsuccessful checks can affect preparation. A credential record does not prove a return or invoice was submitted; preserve the later transaction's own outcome separately.

Check company access against the intended signing action

Have the person in charge (PIC) verify the relevant delegation. Under DGT's role assignment procedure , the PIC works in the represented company's context and uses the representative/authorized-person area, Wakil/Kuasa Saya, to assign a role. A drafter prepares a document; a signer signs it. Select the role for the document category rather than assuming that access to one tax function covers another.

If the recipient was logged in when a role was assigned, DGT instructs them to log out and sign in again. Select the intended company, check the function, and record the company and document category beside the credential evidence.

Consider a hypothetical company where an employee can prepare a VAT invoice and has a valid KO DJP, but only a drafting role. Replacing the credential would address the wrong component: the PIC needs to review signing authority and the assigned role. Conversely, a correctly delegated signer with an invalid credential needs to resolve credential status. This distinction prevents a permissions problem from becoming a repeated certificate request.

Check access readiness first, then preserve the genuine transaction's outcome when it occurs. Do not submit a dummy return or invoice to demonstrate that credentials work.

Renew credentials and remove obsolete company access

Monitor the expiry shown for the actual credential. DGT's validity guidance directs users to the certificate table's end-date column. KO DJP renewal is handled through Coretax, whereas an external electronic certificate is renewed through its issuer. Use the displayed date in the control sheet; do not apply an assumed lifetime to every credential.

For a forgotten KO DJP passphrase, DGT's reset guidance says to follow the same procedure as requesting a new code. That is different from recovering the account's login password. After replacement, update the status and expiry record so the team does not continue treating an earlier entry as its current signing evidence.

When an employee or adviser leaves, revoke company access that is no longer authorized through the applicable role-management process. A person's credential and their authority for your company are separate records. As an internal control, appoint the replacement, check that person's own credential and review every affected document category before relying on the new arrangement.

Maintain an issue log identifying the person, company, document category, error and corrective action. Redact secrets from screenshots and support requests. This distinguishes identity, certificate, permission and document problems without circulating a passphrase. Escalate unresolved identity or authorization conflicts before a live signature.

Release the company signing workflow when the evidence agrees

Approve signing readiness only when the register connects the intended individual, current credential, correct company and relevant signing authority. This is a suggested company control, not an official certificate issued by DGT. Give each outstanding discrepancy an owner and keep the affected signing task pending until it is resolved.

The next action should follow the failed checkpoint: personal access recovery, credential validation or renewal, company-role correction, or review of the underlying authority. Once the preparation agrees, use the authorized signer for the genuine tax task and preserve that task's own completion evidence.