Many taxpayers believe that the most challenging task in Coretax is filling out the SPT. In reality, the first hurdle often arises long before that, namely when preparing the electronic certificate, creating a passphrase, and determining who is allowed to hold the account. Coretax officially takes effect from January 2025, and since then, complaints such as "documents cannot be signed" or "forgot passphrase" have become routine stories heard in tax consultation rooms.
The issue is not merely technical. A faulty account foundation can lead to failed invoice issuance, delayed SPT, or even the company's access falling into the wrong hands. Therefore, understanding these three basic aspects is as important as understanding the tax regulations themselves.
Passphrase Is Not Just a Second Password
A passphrase is often equated with a regular login password, but its function is different. A passphrase is a special password that acts as an electronic signature within the Coretax system. It is used to legalize important documents, from SPT reporting to submitting various applications.
To obtain it, taxpayers must access the "My Portal" menu, then select "Request Authorization Code or Digital Certificate," and specify the type "DJP Authorization Code." At this stage, the passphrase is created. The requirements are quite strict: a minimum of eight characters, containing uppercase letters, lowercase letters, numbers, and special characters. Certain symbols are also not allowed. Once the process is complete, the system displays a notification that the digital certificate has been successfully created.
If You Forget, There Is No "View Passphrase" Button
This is the part that often causes panic. Coretax stores the passphrase with one-way encryption, so the system intentionally does not provide a feature to view the passphrase that has already been created. This means that once forgotten, there is no shortcut to peek at it.
The solution is not to reset in the sense of recovering the old one, but to reapply for the authorization code and create a new passphrase through the same menu. It is important to note that this mechanism automatically deactivates the old passphrase, so the previous password can no longer be used to sign documents. The situation becomes more complicated if the registered email or phone number can no longer be accessed. In such cases, taxpayers are required to visit the Tax Service Office where they are registered for direct identity verification before the account can be linked to new contacts. This can be cumbersome and time-consuming, especially close to reporting deadlines.
Regarding Who Can Hold the Account: PIC and Impersonate
For corporate taxpayers, there is an additional layer that is equally important. When a corporation is first registered in Coretax, one of the administrators is automatically designated as the person in charge or PIC. The PIC has full access rights and all roles over the corporate account when using the impersonating feature.
Interestingly, the PIC does not have to do everything alone. They can grant limited access rights to relevant parties, such as employees or proxies, with clear role limitations. Some may only be authorized to create and sign invoices, others to create withholding evidence, and some may only prepare SPT reports. Each individual is still required to perform personal authentication and hold a confidential authorization code. This separation of roles is not a formality but a means of internal control that reduces the risk of access by unauthorized parties.
Why This Foundation Matters
Orderliness at the beginning determines smoothness later on. A passphrase that is diligently recorded, an active certificate, and well-organized role distribution ensure that tax obligations proceed without drama as deadlines approach. Conversely, an account with a messy foundation tends to create a series of problems that consume even more time.
Tax digitalization indeed promises a more streamlined process, but this ease is only felt by those who prepare their foundations correctly. Mastering access administration turns out to be just as crucial as mastering the substance of the tax itself.
Sources
- Directorate General of Taxes, Complete Guide to Using the Coretax Application: How to Create an Account, Password, and Passphrase, pajak.go.id
- Directorate General of Taxes, Coretax DJP: Provides Impersonate and Assign Role Features to Execute Corporate and Government Agency Roles, pajak.go.id
- Ortax, How to Apply for an Electronic Certificate and DJP Authorization Code in Coretax, ortax.org
- IDN Times, How to Safely Overcome Forgotten Passphrase in Coretax, idntimes.com