The AT refuses the credentials (user or password)

Symptom

A communication to the Tax and Customs Authority (AT), for example Communicate to the AT on a series, opens Invalid Operation saying the credentials are not complete and that nothing was sent. Or the AT answers that the user or the password is wrong.

How to create the credentials is in How to connect fiscaldoo to the Tax and Customs Authority. This article covers what goes wrong afterwards.

Message

Seen with the demo administrator, in Empresa Demonstração, Lda, after its AT credentials were deleted (the demo comes with fictitious credentials). On a new series in Draft (FT E2T26, [FT] Fatura, journal Sales, fiscal year 2027), Communicate to the AT:

“Company Empresa Demonstração, Lda has no complete AT credentials for the test environment (user, password, certificate and private key), so nothing was sent. Fiscal Administration can enter them in Accounting › Configure › Certified invoicing › AT credentials.”

In the message, “test” is the Environment chosen in the credentials: the AT's test environment.

The AT refuses the user or the password. With complete but synthetic credentials (the incomplete-credentials warning disappeared and Used for sending was ticked), and the AT simulator in the refused-authentication scenario, on a new series FT C27 (fiscal year 2027, in Draft): Communicate to the AT opens the Communicate the series to the Tax Authority window, with what is going to be sent. After you tick “I confirm that these data are correct and can be communicated” and click Communicate, the series:

• stays Draft;
• shows the AT's answer on top, with the code: “[99] Simulated rejection”;
• has AT communication set to Rejected.

The text “Simulated rejection” comes from the AT simulator of the test database. The real AT returns its own text. Pending validation on screen: the code and text the real AT returns for a wrong user or password have not been seen (the real AT is not used in tests).

In Tax Authority credentials › New, with only the Web-service user filled in, the form warns at the top:

“These credentials are incomplete: still missing password, client certificate, private key. Until they are filled in, this company cannot communicate with the Tax Authority.”

Verified causes

• The company has no AT credentials, or they are incomplete. fiscaldoo only communicates with the web-service user, password, client certificate and private key all filled in, and the AT public key for the chosen environment. On a test database, the AT simulator asks for the same as the real AT: without complete credentials, it refuses before sending.
• The series has another problem before the credentials. On the same series with fiscal year 2026, Communicate to the AT was refused earlier, because series FT D26 was already active for [FT] Fatura in 2026. That case is in There is no active series for this document, or there is more than one.
• The server does not have the vault's encryption key. Save on the credentials gives “This server has no encryption key for the credentials vault, so nothing was saved and nothing was revealed…”. Seen in this round; the fix is for the system administrator and is in Connecting to the AT, Common problems.
• The AT refuses the user or the password. fiscaldoo sends, the AT refuses and the answer stays on the series: AT communication set to Rejected and the AT's code and text on top of the series. The series is not activated. On the test database, the simulator gives “[99] Simulated rejection”.

What to check

1. In Accounting › Configure › Certified invoicing › Tax Authority credentials, whether there is a line for the company for the Environment in use (test or production) and whether Used for sending is ticked on it.
2. In the form, the warning “These credentials are incomplete: still missing …” and what it lists.
3. Valid until (of the certificate) and AT public key valid until.
4. On the Portal das Finanças, that the Web-service user is a sub-user of the company, written as NIF/número (for example 509999999/1), with the current password and the permissions for the services you will use (series, invoices, delivery notes). Pending validation on screen: creating the sub-user and choosing the permissions on the Portal das Finanças have not been seen.

How to fix it

Done with the demo administrator. The Tax Authority credentials belong to the administrator and to Fiscal administration (see Connecting to the AT, “Before you start”).

1. Open Accounting › Configure › Certified invoicing › Tax Authority credentials and the line for the company and environment (or New, if there is none).
2. Fill in what the warning lists as missing: Web-service user, Web-service password, the Certificate file (.pfx) with the Password of the .pfx (the certificate and the private key are extracted on saving) and the AT public key (PEM).
3. Save and check that the incomplete-credentials warning disappears.
4. Go back to the document or the series and click Communicate to the AT again.

If the series ends up with AT communication set to Rejected and the AT's answer says the user or the password is wrong: log in to the Portal das Finanças with the company's tax number (NIF), check the sub-user and the password (and the permissions), correct the Web-service password in fiscaldoo and communicate again. A password changed on the Portal must also be changed in fiscaldoo.

A refused communication was not made

When the message says “nothing was sent”, the AT did not receive the series or the document. Do not use the series or treat the document as communicated until the communication is accepted.

Expected result

• Communicate to the AT no longer gives the credentials refusal and the series is no longer Rejected. The series moves on to the validation code (Series without a validation code).
• The credentials form no longer shows the warning “These credentials are incomplete…”.

When to contact support

• The credentials are complete, with no warning, and the refusal “has no complete AT credentials” persists.
• The Portal das Finanças accepts the sub-user and the password and the AT still refuses fiscaldoo's communication.

Information to send

• The company and the environment (test or production).
• The full text of the message, copied from the screen. Never send the password or the certificate.
• What was communicated (series or document) and when.
• The profile you logged in with.