Spain — Verifactu / TicketBAI / SII Sandbox Onboarding

Operational guide for getting test credentials at the three Spanish fiscalization channels.

Spain has three separate channels with overlapping but distinct credentials:

• Verifactu (AEAT) — generic e-invoice reporting
• TicketBAI — Basque-territory POS receipts (3 separate territories)
• SII (AEAT) — VAT bookkeeping

Verifactu (AEAT)

Property	Value
Authority	AEAT (Agencia Tributaria)
Sandbox base URL	https://prewww1.aeat.es/wlpl/TIKE-CONT/ws/SistemaFacturacion/SistemaFacturacionWS
Cost	Free (FNMT cert is free for taxpayers)
Time to provision	1-3 weeks
Identity required	Spanish NIF + FNMT or Camerfirma certificate

Steps

1. Apply for an FNMT cert at fnmt.es with your NIF (representante de persona física or persona jurídica).
2. Verify identity in person at a Spanish Tax (Agencia Tributaria) or Social Security office.
3. Download the cert (browser-based PKCS#12 export).
4. AEAT preproduction is open to any cert-holder — no separate registration required.

Secrets

ES_AEAT_VERIFACTU_PFX_BASE64
ES_AEAT_VERIFACTU_PFX_PASSWORD

TicketBAI (3 Basque territories)

Three foral haciendas, each with its own portal and certificate:

Territory	Sandbox base URL	Portal
Bizkaia	https://pruebas-ticketbai.bizkaia.eus	bizkaia.eus
Gipuzkoa	https://tbai-prep-gfb.egoitza.gipuzkoa.eus	gipuzkoa.eus
Araba	https://pruebas-ticketbai.araba.eus	araba.eus

Cost: Free. Time: 1-2 weeks per territory.

Steps (per territory)

1. Register as a TicketBAI software developer with each territory you need.
2. Each territory issues a separate certificado de dispositivo for testing.
3. Register the device(s) in each territory's portal.

Secrets (per territory)

ES_TBAI_BIZKAIA_PFX_BASE64
ES_TBAI_BIZKAIA_PFX_PASSWORD
ES_TBAI_GIPUZKOA_PFX_BASE64
ES_TBAI_GIPUZKOA_PFX_PASSWORD
ES_TBAI_ARABA_PFX_BASE64
ES_TBAI_ARABA_PFX_PASSWORD

SII (AEAT)

Property	Value
Authority	AEAT
Sandbox base URL	AEAT SII preproduction (different endpoint from Verifactu prep)
Identity	Same FNMT cert as Verifactu typically
Cost	Free

Secrets

ES_AEAT_SII_PFX_BASE64
ES_AEAT_SII_PFX_PASSWORD

Gotchas

• FNMT cert acquisition requires in-person verification at a Spanish office. If your team has no one in Spain, this is a 4-6 week step (residency complication).
• Cert must be ≥ 2048-bit RSA. 4096-bit accepted cleanly.
• Verifactu hash chain is local — receipts print before AEAT round-trip; sandbox-nightly tests submission, not receipt-print path.
• Verifactu mandatory from 2026 for non-VAT-special-regime taxpayers. Sandbox is in heavy use; occasional throttling.
• TicketBAI has 3 separate registrations. Each territory's cert is different. Each XML schema variant differs slightly (TicketBAI 1.2 vs 1.3) — rust/adapters/spain/src/ticketbai/ already handles this.
• LROE (Libro Registro de Operaciones Económicas) is a separate batch channel from per-receipt TicketBAI submission; it has its own credentials embedded in the same per-territory cert flow but a different endpoint.

Non-resident path

Spain has a back door that other cluster countries do not: FNMT certificates can be issued at a Spanish consulate worldwide, not just at a Tax (Agencia Tributaria) or Social Security office in Spain. Spanish consulates accept the in-person verification step in most countries.

• FNMT via consulate. Free; book an appointment at the Spanish consulate covering your jurisdiction. Lead time is 1-3 weeks depending on city. This is the cheapest non-resident path for Verifactu and SII.
• Camerfirma cross-border. Camerfirma offers issuance for organisations with EU presence and is an alternative to FNMT if a consulate appointment is impractical.
• TicketBAI is harder. Each Basque foral hacienda has its own foreign-software-vendor process. Bizkaia is the most foreign-friendly; Gipuzkoa and Araba require a local representative for some flows. Plan to use a Basque accountant for at least Gipuzkoa and Araba.
• Cheapest dev path: consulate appointment for FNMT (free) for AEAT channels; Basque accountant ~€200-500/month for TicketBAI.
• Production. Spanish VAT registration or branch for direct issuance; platform-serves-merchants model otherwise. TicketBAI in particular is per-merchant per-territory, which keeps the platform out of foral residency scope.

Related

• Adapter crate: rust/adapters/spain/
• Verifactu module: rust/adapters/spain/src/verifactu/
• TicketBAI module: rust/adapters/spain/src/ticketbai/
• SII module: rust/adapters/spain/src/sii/
• Sandbox tests: rust/adapters/spain/tests/sandbox.rs