Chave Móvel Digital for companies: how to accept Portugal's eID
How a company accepts the Chave Móvel Digital: the user flow, the attributes you can request, eIDAS High and Lei 83/2017, the protocol with ARTE, sector rules, limits, a document fallback and a checklist.
In short
Any company in Portugal can accept the Chave Móvel Digital (CMD), the State's mobile login and signature key, by signing a protocol with ARTE and connecting to Autenticação.gov.[7][8] It is notified under eIDAS at level High, and Portuguese anti-money laundering law names it as a valid remote identification means.[1][11]
- The user signs in with a phone number, a four-digit PIN and a six-digit one-time code.[3]
- No public price list for companies: ARTE asks entities to contact it.[9]
- Plan a document route for people who do not have the key.
This guide covers the Chave Móvel Digital from the company side, what people in Portugal search as "chave móvel digital empresa": the user flow, the data, the law, the connection and the fallbacks.
The Chave Móvel Digital links a mobile phone number to a person's identity document. ARTE describes it as an authentication and digital-signature means certified by the Portuguese State.[2] It is run by ARTE, the State's technology reform agency, inside the Autenticação.gov login service, next to the Cartão de Cidadão (the Citizen Card).[7] For the wider picture of both, read our guide to eID verification in Portugal.
Chave Móvel Digital at a glance
The facts a compliance team asks first.
Chave Móvel Digital
Portugal's mobile authentication and signature key
How many people use it
ARTE's July 2026 figures reached the public through the press; we did not find ARTE's own release.
Source: Renascença (Lusa), quoting ARTE, 24 July 2026.[17]
About 1.5 million more signed up in the first half of 2026.[17] No official share of the adult population is published.
- 26 June 2014CreatedLei 37/2014 creates the key.
- 8 April 2020NotifiedOn the EU list at level High.
- 2024AmendedLei 19-A/2024, the fifth amendment.
- 10 July 2027AMLREU rules accept eID for due diligence.
- 24 December 2027WalletsFirms required by law or contract to use strong user authentication, except micro and small ones, accept EUDI Wallets on request.
The Chave Móvel Digital from creation to the EU deadlines.[1][6][14][16]
What the user sees
The user types the PIN on the Autenticação.gov page, so your service never sees it.[3][10]
Confirm your identity
You will continue on Autenticação.gov.
Chave Móvel Digital
Use an ID document instead
1The user picks Chave Móvel Digital and is sent to Autenticação.gov.[3]
Phone and PIN
Enter your mobile number and your four-digit PIN.
Continue
2The user enters the phone number and the PIN they chose.[3]
Security code
Type the six-digit code sent by SMS, email or push.
Confirm
3A temporary six-digit code completes the second factor.[3]
Share your data
- Full nameShared
- Date of birthShared
- Civil ID numberShared
Authorise
4The user consents to the attributes your service asked for.[3]
Identity confirmed
Your details came from Autenticação.gov.
5The user returns to your site with the signed response.[3]
According to Renascença, quoting ARTE, users can also authenticate by QR code or biometrics in the gov.pt app.[17] ARTE's manual describes a QR-code sign-in through its "Sistema de Autorizações" for cross-device use.[10]
The user enters phone, PIN and code
A simplified SAML sign-in. ARTE also offers OAuth and JWT.[7][10]
What a company receives from a Chave Móvel Digital sign-in
There is no fixed data set: the request lists the attributes one by one (for example the date of birth), and the user consents.[10] The catalogue holds more than 40 attributes; these are the common ones.[10]
| Attribute | In the catalogue | With a CMD sign-in |
|---|---|---|
| Full name, first names, surnames | Yes[10] | On request |
| Date of birth, age ("Idade") | Yes[10] | On request |
| Civil ID number (NIC) | Yes[10] | On request |
| Nationality | Yes[10] | On request |
| Tax (NIF), social security (NISS) and health (NSNS) numbers | Yes[10] | On request |
| Photo, MRZ lines, card data | Yes, card attributes[10] | Not confirmed for CMD sign-ins |
| Address | Further attributes exist | Not confirmed |
| The PIN or the code | No | Never |
We found no public confirmation that a CMD sign-in returns the photo or the address, so do not design a face match against a CMD photo. The manual names the identifiers but we found no published formats; ask ARTE. For licensed gambling, according to a reproduction of Regulamento n.º 99/2018, the player check returns the name, the date of birth and the civil ID number.[18]
Level of assurance and legal standing
The Chave Móvel Digital is on the European Commission's list of notified eID schemes at level High, notified on 8 April 2020.[1] Its national basis is Lei n.º 37/2014, amended by Leis 32/2017, 71/2018 and 2/2020, Decreto-Lei 88/2021 and Lei 19-A/2024, and regulated by Portaria 77/2018.[4][6]
For anti-money laundering, Portugal is explicit. Lei 83/2017 lists the key among the means a customer can use to prove identity:
Article 25(2)(b)Lei n.º 83/2017
"b) Através de Chave Móvel Digital"
Source: Diário da República, Lei n.º 83/2017[11]
The same paragraph applies whenever customers have the means and tell the obliged entity they want to use them, and Article 25(3) makes obliged entities provide the technology.[11] Banco de Portugal's consumer portal lists the key as a valid way to prove identity when opening an account remotely.[13]
| Rule | What it says about the CMD | Applies |
|---|---|---|
| Lei 83/2017, Art. 25(2)(b) | Named means for proving identity data | Now[11] |
| Aviso BdP 1/2022, Art. 21(5) | Where no signature image exists, unique identification of the holder covers the signature element | Now[12] |
| Aviso BdP 1/2022, Annex I | Video identification is an alternative that does not displace Art. 25(2) means | Now[12] |
| AMLR, Art. 22(6)(b) | eID at Substantial or High is a verification route across the EU | From 10 July 2027[14] |
From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) takes over. Article 22(6)(b) allows verification by "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high'".[14] A key notified at High fits that test. The Anti-Money Laundering Authority (AMLA) final draft standards of 30 September 2026, sent to the Commission, not yet law, treat the Article 22(6) means as "the default option", with document-based alternatives used only when those cannot be.[15] Our EUDI Wallet page covers the wallet that private relying parties must accept, at the user's request, by 24 December 2027 where law or contract requires strong user authentication. Micro and small enterprises are exempt.[16]
How a company (empresa) connects to the Chave Móvel Digital
There is one official route: a protocol with ARTE for Autenticação.gov. ARTE says the integration is open to the public and private sectors and must be agreed by protocol with ARTE.[8] The steps it publishes:
- Fill in the adhesion form and tick the services you need: the Chave Móvel Digital, the Sistema de Autorizações, GOV.PT, professional attributes and others.[9]
- Send the completed protocol, in an editable format, to eid@arte.gov.pt, quoting the request number.[9]
- Integrate using SAML, OAuth or JWT, following the integration manual (version 1.5.7, November 2021). SAML requests and responses are signed, with the entity's X.509 certificate.[7][10]
On price, ARTE says joining and using the service cost the user nothing, and that interested entities should contact it.[9] We found no public price list, no published lead time and no certification programme for intermediaries (5 October 2026). ARTE does keep a public list of member entities.[3]
Official route
Direct protocol with ARTE
- Your own protocol and certificate
- SAML, OAuth or JWT
- Price on request to ARTE
Autenticação.gov integration page
Through a provider
An intermediary with its own protocol
- No certification scheme published
- Check the provider's protocol terms
- You still choose the attributes
Ask ARTE to confirm the set-up
Without the CMD
Document route
- Chip reading, liveness, face match
- Covers users without the key
- No protocol with ARTE
Lei 83/2017, Art. 25
The same protocol also gives access to the Cartão de Cidadão, so one integration covers both Portuguese eIDs.[7][8] A related service, SCAP, certifies professional attributes (for example a company director) and attaches them to a CMD or card sign-in.[8]
Use cases and sector rules
According to Renascença, ARTE says the key is used from opening bank accounts remotely to paying taxes.[17] By sector:
| Use | What applies |
|---|---|
| Bank and payment onboarding (KYC) | Lei 83/2017 Art. 25(2)(b); Banco de Portugal lists the key for remote account opening[11][13] |
| Online gambling | According to a reproduction of Regulamento 99/2018, operators verify players with the card or the key through the autenticação.gov player registration[18] |
| Age checks | Date of birth and an age attribute ("Idade") can be requested on their own[10] |
| Social media under 16 | A bill approved in general on 12 February 2026 would use the key for age confirmation; final status not confirmed, according to ECO[19][20] |
| Telecom | No CMD-specific rule found; telecommunications is among the sectors eIDAS 2 names for wallet acceptance[16] |
| Signing | The key is a State-certified signature means; CMD signature is a separate function in the protocol[2][8] |
Our eID schemes by country list compares other national eIDs.
Limits and fallbacks
The key does not cover everyone your sign-up will see.
- Foreigners. They can get the key with a passport, a Brazilian Citizen Card, or a residence permit or card plus a Portuguese tax number (NIF), at a service counter. Activation in the gov.pt app with face recognition is only for Portuguese nationals with a valid Citizen Card.[4]
- Non-residents. The foreigner route runs through a service counter, so plan another route for them.
- Minors. There is no age floor, but activation at a counter for a child under 16 needs the child and a parent present.[4]
- Security. The key is two-factor (PIN plus one-time code), and app activation compares the user's face with the Citizen Card image.[3][5] Codes by SMS carry SIM-swap and phishing exposure; we found no public incident reports.
Portuguese law also allows video identification as an alternative procedure, with safeguards such as a traceable first deposit and a prior risk analysis.[12] The other fallback is a document route with chip reading, liveness and face match, as in this design:
1Offer the Chave Móvel Digital first
Show it to users who say they are Portuguese residents.
Does the user have an active key
Sign in with the CMD
Signed name, date of birth and civil ID number.
Verify with a document
Chip reading, liveness and face match. Record why.
2Screen and decide
Sanctions and PEP screening; the decision stays with you.
eID first, document as fallback. If adopted, the AMLA final draft would require justifying Article 7 alternative verification. No application date yet.[15]
Implementation checklist
- Confirm the Chave Móvel Digital is a valid means for your sector in Lei 83/2017 or your regulator's rules.[11]
- Submit the Autenticação.gov adhesion form and tick the Chave Móvel Digital.[9]
- Send the signed protocol to eid@arte.gov.pt with the request number.[9]
- Ask ARTE for the price, the test set-up and the current integration manual.
- Choose SAML, OAuth or JWT and generate your X.509 certificate.[10]
- List only the attributes you need, such as date of birth for age checks.
- Build the document fallback and log the reason for each use.
- Screen every verified customer against sanctions and PEP lists.
How Didit helps with eID verification in Portugal
Didit adds Chave Móvel Digital on request.
For Portuguese users today, Didit runs the document route: ID verification with NFC chip reading, liveness and face match, plus AML screening, in one workflow. A full KYC check costs $0.33 and AML screening $0.20; age estimation costs $0.10 per check. National eIDs from Denmark, Sweden, Finland, the Baltics and Belgium run in our digital ID wallets product (docs). Wallet prices are on the pricing page.
Didit provides
- Document checks with NFC chip reading, liveness and face match
- AML screening against sanctions, PEP and watchlists
- The evidence of every check
Stays with you
- The risk assessment and the choice of Article 25 means
- The onboarding decision
- The reason for each document fallback
Add Chave Móvel Digital to your onboarding
Tell us where your Portuguese users sign up, and run the document route while we talk.
Key takeaways
- The Chave Móvel Digital is notified under eIDAS at level High since 8 April 2020.
- Lei 83/2017 Article 25(2)(b) names it as a remote identification means.
- Companies connect through a protocol with ARTE; the price is not published.
- Keep a document route for foreigners, non-residents and anyone without the key.
Frequently asked questions
Can a private company use the Chave Móvel Digital?
Yes. Autenticação.gov integration is open to public and private entities under a protocol with ARTE. You fill in the adhesion form and send the protocol to eid@arte.gov.pt.[8][9]
How much does the Chave Móvel Digital cost for a business?
ARTE publishes no price list. The key is free for users, and entities are told to contact ARTE for their conditions.[9]
What data does a business receive?
The attributes it requests and the user approves, from the Autenticação.gov catalogue: for example full name, date of birth, civil ID number, nationality and tax number. We found no confirmation that the photo or the address comes back with a CMD sign-in.[10]
Is the Chave Móvel Digital accepted for KYC under Portuguese AML law?
Yes. Lei 83/2017 Article 25(2)(b) names it as a means to prove identity data, when the customer has it and wants to use it. Banco de Portugal lists it for remote account opening.[11][13]
What level of assurance does the Chave Móvel Digital have?
High. It has been on the EU list of notified eID schemes since 8 April 2020. That meets the Substantial or High test of AMLR Article 22(6)(b), which applies from 10 July 2027.[1][14]
Can foreigners get a Chave Móvel Digital?
Yes, at a service counter with a passport, a Brazilian Citizen Card, or a residence permit or card plus a Portuguese NIF. Activation in the gov.pt app with face recognition is only for Portuguese Citizen Card holders.[4]
Can minors use the Chave Móvel Digital?
There is no age floor. For a child under 16, activation at a counter needs the child and a parent present.[4]
How long does integration take?
ARTE publishes no lead time. The protocol is a manual agreement, not a self-serve sign-up, so plan for an exchange with ARTE before the technical work starts.[9]
Is there a test environment?
We did not find a public test environment on ARTE's pages (5 October 2026). Ask ARTE when you send the protocol.
Sources
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, updated 2 February 2026, read 5 October 2026.
- A Chave Móvel Digital, Autenticação.gov (ARTE).
- Como pedir e usar a Chave Móvel Digital, Justiça.gov.pt.
- Ativar a Chave Móvel Digital, gov.pt, updated 22 September 2026.
- Chave Móvel Digital com biometria, digital.gov.pt.
- Lei n.º 19-A/2024, Diário da República (amends Lei 37/2014).
- Serviço de Autenticação, Mosaico (ARTE), updated 5 June 2026.
- Integrate with Autenticação.gov, Autenticação.gov (ARTE).
- Pedido de adesão (entity adhesion form), Autenticação.gov (ARTE).
- Manual de Integração do Fornecedor de Autenticação v1.5.7, ARTE, November 2021.
- Lei n.º 83/2017, Diário da República (AML law).
- Aviso do Banco de Portugal n.º 1/2022, Diário da República.
- Abertura de conta, Banco de Portugal, Portal do Cliente Bancário.
- Regulation (EU) 2024/1624 (AMLR), Article 22, EUR-Lex, Official Journal of 19 June 2024.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- Regulation (EU) 2024/1183 (eIDAS 2), EUR-Lex, Official Journal of 30 April 2024.
- Chave Móvel Digital ultrapassa os 5 milhões de utilizadores ativos, Renascença (Lusa, quoting ARTE), 24 July 2026. Secondary source.
- Regulamento n.º 99/2018 (SRIJ), reproduction on informador.pt. Secondary source.
- Assembleia aprova proibição do acesso livre a redes sociais a menores de 16 anos, ECO, 12 February 2026. Secondary source.
- Lei que restringe redes sociais a menores de 16 deverá estar pronta em outubro, ECO, 31 July 2026. Secondary source.
Compare the Chave Móvel Digital with every other national eID on our eID verification page.
One workflow for Portugal and beyond
Start with documents and AML screening today, and tell us which eIDs your users already carry.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards