How-to guide
REGES API credentials and secure connection setup
Find the employer API credentials, configure the connection, understand where secrets are stored and replace access safely.
This guide covers connection setup. Reporting changes directly from saved employee and contract records is still being prepared for release. A valid connection does not mean those changes are sent automatically.
For the manual route, follow the illustrated REGES export and Management AZ import guide. File imports do not require you to save REGES API credentials.
Before API setup: activate your personal REGES account
Confirming the registration email only verifies your mailbox. It does not verify your identity, give you access to an employer register or create external-system API credentials. If REGES says the account needs activation, complete the identity step first.
For a development demo, follow the test-account steps below. The ROeID and qualified-signature instructions in this first section describe production activation.
Go to development test activation
Production activation
Use ROeID
If you already have an active personal ROeID identity, sign out of REGES. On the REGES sign-in page, choose ROeID and complete the identity-holder approval in the official ROeID flow. If you do not have ROeID, follow the official enrolment instructions yourself on your phone. Check the signed-in identity when you return; it may be a different account from the email-and-password account you created.
Or activate with your qualified electronic signature
Sign in with your email and password. Open your name, then Setări profil and Activare semnătură digitală, or follow the Activare cu semnătura digitală link on the activation screen. Use the ANAF confirmation document signed by you and countersigned by your certificate provider. Check the extracted personal details and complete the declaration and submission yourself. The signature and identity must belong to the account holder.
Then confirm employer access
Open the employer application and check that you can select the intended employer register. Personal identity activation and employer authorisation are separate steps. If the register is missing, its authorised administrator must arrange access through the official REGES process. Continue below only after the correct register is available.
The official employer access guide explains ROeID, signature activation and employer authorisation. Keep your identity document, signature PIN and personal authentication approvals with you; they are not Management AZ connection fields.
Official REGES employer access guide
Activate a development test account without ROeID
On 18 October 2026 we activated our fictional demo account through the development signature form with a clearly labelled unsigned test PDF. The community reply linked below describes this route. ROeID enrolment was not needed for this development trial.
Development activation discussion in the REGES integration repository
Development only: use reges.dev.inspectiamuncii.org and check the visible test-environment banner. Use the test identity agreed for your isolated demo. Production identity and employer authorisation must follow the official production procedure.
Sign in to the REGES development portal with the account whose email you confirmed. If the portal still asks for activation, continue with that account.
Choose Activare cu semnătura digitală on the activation screen. You can also open your name, Setări profil, then Activare semnătură digitală.
For this development demo, enter the agreed fictional test details and attach a PDF clearly marked REGES DEVELOPMENT TEST ONLY. The unsigned PDF is test material, not a qualified signature or an identity document.
Read the declaration and submit the development activation request. If the page stays busy or the status is stale, refresh or sign out and sign in again before submitting anything twice. Check Status solicitări și sesizări for Contul a fost activat!.
Open the development employer application and select your dedicated test register. If access is missing, use Registre, Cerere acces and the test employer you are authorised to use. A new individual-employer register can ask for employer details before it becomes available. Account activation and register access are separate checks.
Optional alternative: ROeID beta
REGES development opens the ROeID beta sign-in page. New beta accounts are enrolled through the separate Android test app, including identity-image and selfie checks. Follow the ROeID test instructions for the matching app; the production app does not authenticate against beta.
ROeID test-environment instructions
1. Get credentials for the correct employer
Sign in to the official REGES employer application and select the employer register you are authorised to manage. Ask your employer administrator for help if you cannot access that register.
Open Setări → Angajator → Utile. In Acces sistem extern, use Obține credențialele to obtain the credentials for an external application. The official REGES help page describes this screen.
Use the external-system username and password, rather than your personal portal sign-in password. The user ID and employer ID shown under API keys are identifiers; they are not a substitute for the password.
REGES delivers the generated external-system username and password in its application messages. Open the new credential message and transfer the values directly into the Management AZ credential fields below. Keep that message and its screenshots private.
An active API key can put web editing of the register into read-only mode. Use a dedicated test register. Do not unlock a shared register or replace another integration key just to run a demo.
Development credentials belong to the REGES development environment. Production access must be enabled for the production integration; do not copy credentials from public test examples.
2. Save the connection in Management AZ
Where guided setup is available, open REGES Online under Imports & sources or Data sources, then choose Prepare reporting to REGES. Answer the employer-access and existing-application questions. If someone else manages the register, use the checklist with that person before generating credentials. The guide opens the existing secure connection form only after you confirm access and that no other application reports for you.
Do not regenerate another payroll provider’s key to complete setup. Read-only guidance does not invite another user, store credentials or enable government reporting.
Where saved setup is available, select Save and return later to keep your place for the same account and organisation. Resume setup opens the saved help or asks you to confirm employer access and other reporting applications again. Progress contains only the task and guide step, never passwords or access approvals. Clear saved place does not disconnect an existing source or revoke credentials.
In Management AZ, open Settings, then Data sources. Open REGES Online and follow the reporting route above. If your screen lists REGES Online reporting separately, open that API reporting source.
Where the simplified form is available, enter only External-system username and External-system password, then select Save and check connection. Production settings and any platform OAuth secret are managed for you. Do not paste a personal password, ID utilizator or ID angajator into these fields. If you use the older form, give the source a recognisable name and leave the optional client secret blank unless your integration administrator has supplied it.
Submit the form once. Credential fields are not filled back in after an error. If secure storage is unavailable, the connection cannot be saved with a password in the database as a fallback.
If a REGES source already exists, open it instead of adding another one. Choose Replace saved credentials only when you intend to change that source. The simplified replacement form checks the source revision, keeps a paused source paused and retains any operator-managed OAuth secret. If the check fails, the existing connection stays in use and the input fields are cleared for a fresh attempt.
3. Test access and read the result
When the reviewed reporting setup is enabled, saving credentials obtains the connected employer reference from REGES. Open Connection settings and check Connected REGES employer reference. You do not need to enter or edit this identifier yourself.
For an older connection without an employer reference, replace its credentials once and check the result. Credentials for a different employer require a separate source; replacing credentials must not silently switch the employer.
Open Connection settings and select Test connection. This checks access to the employer profile. If it fails, check the employer, environment and credentials before trying again.
A successful connection test does not submit employees or contracts. For a submission, a receipt means queued; the later REGES processing result determines acceptance or rejection. Check an unconfirmed delivery in REGES before sending it again.
Understand REGES delivery and processing results
Where the credentials are stored
The credential-save flow uses Google Cloud Secret Manager. The application database keeps credential references and connection status, rather than the username, password or client secret values. The stored values are not available to view or download from the source page.
The integration service retrieves credentials when it needs to authenticate. Managed storage must be configured before credentials can be saved. Operators must restrict service access to the relevant managed secrets and keep audit records without recording their values.
4. Replace or revoke access
Your existing connection stays in use until the replacement credentials pass the check. A paused source stays paused.
Open Connection settings, then Replace saved credentials. In the simplified form, enter both new external-system values and select Save and check connection. Other connection settings are retained. In the older form, enter every required replacement value and select Save and test credentials; leaving its optional field blank removes that saved value after a successful check. Check the result before relying on the connection.
Replacing stored credentials does not revoke access at REGES. If a credential has been exposed, ask the employer administrator to revoke or regenerate it in REGES, then update this connection. Pausing a source stops new work through that source; it does not revoke the external credentials.
For support, share the organisation, time of the attempt and displayed error. Do not include passwords, client secrets, tokens or screenshots of the credential values.