How Do I Create a Machine Credential?

Machine credentials are what allow your payroll data to be securely sent and verified by the ATO when using Single Touch Payroll on the desktop Lightning Payroll application. The following FAQ will guide you through the steps to download a machine credential for your business. There is nothing you need to do in Lightning Payroll to link your machine credential, it is automatic so long as you complete the steps below.

If you get stuck, please contact the ATO's Technical Helpdesk on 1300 287 539 (option 3 for RAM). If the ATO representative advises that you need to get an SSID, ABN or Software ID from us, this is not correct, as you are using a desktop application, not an online one. You simply need a machine credential. Please see here if you are told this.

Also, we have been informed that if your business is a trust you will likely need to contact the ATO hotline above to have them manually link you to your ABN, or else it will not be available in RAM.

Note: This guide requires you to use Google Chrome web browser. If you don't have Google Chrome installed on your computer, you can visit the Google Chrome page here to download it.

What Do I Need To Do?

A) Install Both Required Software

1) Download the myID (your Digital ID, formerly called myGovID) app to your smart device and set up your myID using your identity documents.

2) On your Lightning Payroll computer, you will need to install the ATOBE extension to continue. Depending on your operating system, download and install the appropriate version of ATOBE below.

After installing the correct version of the ATOBE extension, continue with the setup process in Chrome.

If you are still getting the 'software required' error in RAM, despite installing the ATOBE extension via Chrome browser, please click the link here and manually download and install the extension from beneath the 'Before you start' header.

You should check that the extension is showing and is active by going to the menu option (three dots) at the top-right corner of Chrome browser, then clicking Extensions >> Manage Extensions. The ATOBE extension should now be seen here, and the toggle should be blue, with the white circle on the right side, indicating the extension is switched on.

B) Create and Download Your Machine Credential

Once you have installed the required software, you can create your machine credential. These new credential files last for two years, so this process might seem painful, but it is not going to be a frequent exercise, and you can also quickly renew your machine credential (before expiry) in the program via Tools >> Renew Machine Credential >> Attempt Renewal in the future. For detailed instructions from the ATO on creating a machine credential (including pictures), see here.

The usual process is to:

1. Open your myID app on your smart device, then login to the ATO's Relationship Authorisation Manager (RAM) using the same Chrome or Firefox web browser that the ATOBE extension was installed onto.

2. Click View or manage authorisations, machine credentials and cloud software notification.
3. Click on your business/company name in blue writing (not on 'View').

   • If the business is not visible you need to click Link your business on the main RAM entry page, then follow the prompts. Only the ABN's principal authority can claim the ABN. Update your ABN details with the Australian Business Register if your ABN is not linkable in the RAM website.

   • If the business is visible, but unclickable, then you do not have correct administrative privileges and will need to contact your principle authority or the ATO for assistance.
4. Click Manage Credentials at the top of the page.
   • If this option is not visible you are not a machine credential administrator and need to contact your principle authority or the ATO for assistance.
5. Click Create Machine Credential and follow the prompts. Please take note of the following tips:
   
   • If you get a Software Required error, the browser extension software is not being detected. We have a FAQ on this.
   • When creating your machine credential, do not change the keystore path as Lightning uses this to automatically detect the new keystore file, meaning it will be ready to go in Lightning as soon as you've downloaded it from RAM.
   • Create and remember a new keystore password as this will be required to submit through Lightning Payroll. This password cannot be reset, so please be sure to remember it. Note that if you already had an existing machine credential, but it expired, you will be asked for this password instead of being asked to create a new one. If you elected for Lightning Payroll to save your keystore password in the program, you can find your existing keystore password in Lightning Payroll by going to Tools >> Renew Machine Credential and clicking Show Password here. You can then cancel out of the renewal tool, as it cannot be used to renew an already-expired or revoked machine credential.
     
   • The credential name is up to you and usually is a word which represents the PC you use Lightning Payroll on (E.g. Reception, admin, office, etc.). It cannot contain spaces or special characters.
     
   • Agree to the terms and click Download at the bottom of the page.
   • Lightning Payroll will then automatically detect your new keystore, so there is no need to import it or do anything on your end to make the machine credential available in the program. You will be able to select it and enter the new password (unnecessary if using the previously saved password) when you next submit STP through the program.
     
6. Repeat steps 1-5 for any additional ABNs you process STP for on this computer, using the same password for each.

C) Test Your New Credential

To test your new credential has been installed correctly, go into the Pays screen within Lightning Payroll and click Single Touch >> Submit Payroll to the ATO. On the preview/submission screen (seen after you click Next) you should see the new credential in the dropdown list with a new expiry date two years in the future.

If you have followed all of the step above but you can still only see the expired machine credential, you might be running an old version of Lightning Payroll. Please see our FAQ here for help updating.