Certificates for the production environment
Deploying application to production
The instruction is divided into actions of the organization using the interface and the software developer.
An organization using an interface
The user organization of the interfaces, the user of the software, is required to have a production certificate. The production certificate acts as the user's identifier. The user of the interfaces can be the customer, i.e. the obliged entity himself or a party authorized by him or herself, in accordance with the terms of use of the interfaces.
Software developer
Software developers register their software in the API portal and selects the interfaces they use before starting production use. The registered software receives an API key. The API key is software-specific and acts as a software identifier. The API key is not intended to be managed by the users of the software, and the software developer should build the key handling inside the software.
The software developer should ensure the technical functionality of the software's production connection and API key against the interfaces it uses. The verification is done independently against the integration verification address published in the API portal (URL Integration verification).
After verification of the integration, the software is ready for production.
Learn more about software registration
How to apply for a production certificate:
The organisation that wants to have a certificate subscription must have an agreement on the provision of services with their customer within the meaning of the terms and conditions of interface services. You may have a software program designed for accounting firms or other third-party providers of services to taxpayers. If the users of your software are usually not taxpayers or filers, the users must submit applications for certificates
- Submit an interface application and request a certificate in the Tax Administration’s certificate service.
- The requesting of production certificates has been transferred on October 24, 2024, from the Incomes Register's e-service to the Finnish Tax Administration’s certificate service.
- Review production certificates instructions for the Tax Administration's certificate service.
- After successful retrieval, the technical contact person specified in the application imports the certificate into the software. If the user organisation does not have a valid certificate, Vero API will not transmit the records the organisation requests.
- Vero API responds to calls made with production certificates only after the certificate has been retrieved and installed in the organisation’s environment. Certificates for Vero API are retrieved from the Incomes Register's certificate service. In general, production certificates generated in the certificate service during office hours (8.00 am to 4.15 pm) will work in Vero API calls at the latest on the following day.
Notes for IT developers:
- After retrieval of a certificate, the commercial software vendor must give sufficient guidance to their customers, the user organisations, on how certificates must be handled when the software program is being used.
- The user organisation’s certificate must be fed into the software program because it replaces the user organisation’s electronic signature.
- The Tax Administration recommends that software programs are encoded so as to support certificate-based authentication and production certificates.
Production environment
Documentation for Vero APIs and production environment URLs can be found on the Vero API portal.