INDONESIA TAX ADMINISTRATION
Indonesia Coretax Company Setup: Access, Roles and Signing
A controlled corporate-access model for Coretax DJP: activate the right account, assign roles deliberately and keep electronic signing with an authorised person.
A company’s Coretax setup is not the same thing as incorporating the company or registering a new NPWP. It is the controlled connection between an existing taxpayer record, a real person with authority to act for the company, the role needed to use a function and, where required, the DJP electronic signing code.
The practical danger is giving an accountant or vendor a shared password, or treating a Coretax role as proof of corporate authority. Establish legal authority, platform access and signing authority separately. That protects the company when directors, tax staff or advisers change.
Key takeaways
- Activate the taxpayer account before a deadline forces the issue. Coretax is used across registration, reporting, payment and administration, so contact data and account recovery matter.
- Keep the person responsible and operational users distinct. A corporate taxpayer needs a defensible route from company authority to platform action.
- Use roles rather than shared credentials. Impersonation and added access roles should be granted narrowly, documented and reviewed when staff or advisers change.
- Electronic signing is its own control point. A valid Kode Otorisasi DJP or digital certificate is not simply a login password and should not be treated as a generic team credential.
- Profile accuracy is a compliance input. Wrong NPWP, address, email, mobile number or representative information can block otherwise routine Coretax work.
Separate company formation from Coretax setup
Coretax DJP is the Directorate General of Taxes’ integrated administration system. DJP describes it as covering core processes from taxpayer registration through returns, payment, audit and collection; the authoritative product page is DJP’s Coretax information page . That breadth is exactly why a company should treat access as a governance task rather than an afterthought for the finance team.
First complete the company’s actual formation, tax registration and profile work. Then build access to the taxpayer record. For a foreign-owned entity, the NPWP registration path for a foreign-owned PT PMA is the foundation; Coretax access does not cure missing or inconsistent taxpayer data.
Equally, do not put “Coretax account created” on an incorporation checklist as if it were a government approval. It is an operational readiness step after the taxpayer record exists. The Indonesia company setup process remains the separate route for the entity, its address, management, KBLI and registrations.
Check the taxpayer record before access
Confirm the corporate data, representative details and contact channels first, then set up the access model around the people who can actually act for the company.
Activate the corporate taxpayer account safely
DJP’s practical activation guidance starts with an existing NPWP. The user enters the NPWP in Coretax, uses the email address and mobile number recorded with DJP, verifies identity, receives a temporary password through an official @pajak.go.id email, changes the password and creates a passphrase. The detailed steps are published in DJP’s activation and authorisation-code guidance .
For a company, make a written record of who supplied each contact detail and who controls recovery. Use a company-controlled mailbox wherever the taxpayer record permits it, with access governed by the company—not a personal employee inbox or an external adviser’s mailbox. If the registered email or mobile number is stale, correct the taxpayer data before trying to force an activation flow.
Once the account works, inspect the profile, location and relevant tax status before any routine filing begins. Coretax’s “Portal Saya” exposes taxpayer profile information and related administrative requests, so an early profile check is more valuable than discovering a mismatch during a VAT, withholding or annual-return deadline.
Make activation verifiable. Save the official issuance email, note the account owner and login date in the company’s tax administration file, and record the recovery channel. If a company cannot identify the holder of its registered Coretax contact details, it does not yet have a resilient account model.
Map authority, impersonation and access roles
DJP publishes a dedicated corporate-taxpayer guide covering the person responsible, impersonation and the addition of access roles. Use that vocabulary to set a simple operating model; do not assume that every accountant needs every menu or that a system profile alone changes a company director’s legal authority.
| Control layer | What it answers | Evidence to retain |
|---|---|---|
| Corporate authority | Who may legally act for the company? | Articles, board or shareholder authority, and any valid appointment |
| Taxpayer responsibility | Who is reflected as the corporate taxpayer’s responsible person? | Coretax profile check and update record |
| Operational access | Who may use which corporate functions through a role or impersonation? | Role register, scope and offboarding date |
| Electronic signing | Who can sign or authorise a tax document? | KO DJP or certificate status, holder and validity check |
Review this map at onboarding, whenever a director or tax lead changes, and before ending an adviser engagement. No person should retain company-tax access merely because they once helped create the account.
For each access grant, document the person, job or adviser relationship, permitted actions, authorising document, date granted, renewal date and removal trigger. The company should be able to revoke operational access promptly without disrupting the legally authorised representative or the separate signing process.
Give each Coretax role an owner
An access register with role, person, basis of authority, scope, expiry and review date is safer than an informal handover to finance.
Secure electronic signing separately
DJP’s Kode Otorisasi DJP (KO DJP) is its official electronic signature. The Coretax process can involve a request for the authorisation code or a digital certificate, a signing identity or passphrase, and a subsequent status validation. Use the company’s signing policy to decide who may hold and use it. A finance manager’s access to prepare a return does not automatically mean that manager should be the person who signs it.
At minimum, retain the certificate or KO DJP issue record, validity status, authorised holder, issuance date, company resolution or internal approval and a controlled way to recover access. Do not store a passphrase in the accounting file, share it over chat or leave it with a former outsourced provider. Electronic signing should be auditable from the company decision through to the tax document that uses it.
Before a first major filing, run a non-production readiness test: can the current authorised person log in, select the company correctly, retrieve the required role, find the certificate status and complete the intended action? If not, resolve the authority or data issue before the deadline, rather than trying to patch access during submission. This test should be repeated after an authority, signer or technical contact changes.
Decide the Coretax owner model
A lean company can use a simple model: a properly authorised company representative, one controlled corporate mailbox, a narrow operational role for the finance lead and a separate electronic signer. A larger group may need more roles, but it should still be able to answer the same questions: who owns the profile, who can prepare, who can submit, who can sign and who removes access when people leave.
Escalate before filing if the legal representative on the corporate record has changed, the only recovery email is personal, a tax adviser insists on shared credentials, the certificate status is not valid, or staff cannot evidence their role. Coretax access should survive personnel changes without leaving the company unable to act or unable to explain who acted.
Put company tax access under control
We can help you turn your company information, tax-registration status and operational responsibilities into a clear setup checklist for the right people.
Frequently asked questions
Does creating a Coretax account register a new company?
No. Company incorporation, taxpayer registration and Coretax access are connected but separate steps. A Coretax account is used to administer an existing taxpayer record.
Can an outsourced accountant use the company’s Coretax login?
Avoid shared credentials. Use the appropriate role, representative or impersonation route, supported by a written authority and an offboarding process.
What is KO DJP used for?
It is DJP’s electronic authorisation code used for electronic signing in Coretax. Treat the issuance, holder and validity status as a controlled corporate record.
What should be checked in the company profile?
Check the NPWP, company name, address, registered contacts, responsible person and relevant tax status before a reporting deadline makes a correction urgent.
When should roles be reviewed?
At least when a director, finance lead, signer, employee or adviser changes—and before a significant tax return or application is submitted.
