Access to the Virtual Private Space is only possible with a qualified digital certificate, and authorising an application is done from your browser, on a computer with the USB token plugged in. There is no username-and-password option, and there is no option from a phone — this is an ANAF requirement, not one imposed by the application you use.
What a qualified digital certificate is
It is an electronic signature issued by an accredited provider, usually delivered on a USB token protected by a PIN. The certificate identifies you to ANAF the way a handwritten signature does on paper, and the private key never leaves the token.
That is why authorisation requires the computer: the token drivers and the browser have to be able to talk to the physical device. A phone has no way to read the token, however good the application.
What authorisation actually looks like
The application sends you to the ANAF authorisation page. There you pick your certificate, enter the token PIN and confirm which rights you are granting. ANAF returns an access token to the application — a kind of temporary key — which lets it read your messages without ever seeing the certificate or the PIN.
It is the same model as "sign in with Google": the application receives a right, not your identity. What it receives is limited to what you approved, and you can withdraw the right without changing anything about the certificate.
Mind this
Authorisation cannot be done from a phone: the USB token has to be read by a computer. That is an ANAF requirement, not the application's.
How long it lasts and what happens when it expires
ANAF limits authorisations to one year. On expiry the application loses access and monitoring stops — with no announcement from ANAF, which means a serious service has to send you reminders ahead of time itself.
Renewing takes a minute, but it needs the USB token again. Worth planning for a day when you are at your desk, rather than discovering it in a month when no alert has arrived.
How to check and how to revoke access
Any application that reads your SPV must offer you a disconnect button that destroys the tokens and asks ANAF to revoke the authorisation. If it does not have one, it is not an application to authorise.
Here the button is in your account, and disconnecting stops monitoring on the spot. We also keep a log of every query made to ANAF — which tax number, which endpoint, when — so that we can answer the question "what did you look at" at any time.