Using a DSC USB token with Tally on Cloud

Can you use a DSC on a cloud server?

Yes, and Tally Solutions says so itself. Its digital signature FAQ states that you can digitally sign documents on cloud platforms "as long as the virtual computers are Windows based and can be accessed through RDP". With Tally on Cloud, TallyPrime runs on exactly that: a Windows server you reach over Remote Desktop. The same FAQ adds one firm rule: the dongle must be connected to your local computer, not plugged into a server somewhere else.

The bridge between the two is smart-card redirection. A DSC USB token, such as an ePass2003, a ProxKey or similar model, presents itself to the computer as a smart card in a built-in reader. Remote Desktop can pass that reader into your session, so the server sees your token as if it were plugged into the server. When TallyPrime or a filing portal needs a signature, the request travels to the token in your laptop, the token's chip signs it after you enter your PIN, and the signature comes back.

Two things follow from this design. First, the token never has to leave your desk, and the certificate's private key is not copied to the server. Second, each person who signs needs the token at the computer they connect from. Smart-card redirection is one of the everyday jobs covered in our guide to how Tally RDP works, alongside printers, drives and the clipboard.

Which devices can use a DSC token

Microsoft's Windows App feature comparison (updated September 2026) is the reference here. It lists smart-card redirection as supported on Windows and macOS, in preview on iOS and iPadOS for YubiKey only "due to iOS/iPadOS limitations", and not supported on Android, ChromeOS or in a web browser. That table is written for Azure Virtual Desktop and Windows 365, so treat it as a strong guide for a Remote Desktop server like ours rather than a guarantee for every token.

Based on Microsoft's Windows App documentation, Tally's digital signature FAQ and Remmina's feature list, checked on 2026-10-06. This is a documentation summary, not a lab result. We name token models as confirmed only after we've tried them ourselves, so until then treat your token as "test it during your free 7-day trial".

Check your device and task

Pick the device you'll sign from and what you need to sign. The checker tells you whether it works in your cloud session, needs a test first, or needs a different route, with the setup steps.

Set up: token drivers on both ends, then switch on smart cards

Most "token not detected" problems come from skipping one of three pieces. Get all three in place once and signing becomes routine.

1. The token driver on your own computer

Your computer must recognise the token before it can share it. Install the driver or "token manager" software from the token's maker or from the Certifying Authority that issued your DSC, plug the token in, and check that its utility shows your certificate. On a Windows laptop with an Arm processor, look for an Arm64 driver specifically: Microsoft notes that x64 emulation on Windows on Arm doesn't support drivers. On a Mac, install the macOS driver if your token's maker offers one for your Mac's chip. If it doesn't, use a Windows PC for signing.

2. The same token's driver on your cloud server

Tally's FAQ says you also need to "install token software on the remote machine", because programs on the server talk to the token through its driver. Each TallyoCloud customer gets a private server, so this is a one-time job: send our support team your token's make and model and we install the matching Windows driver, plus the GST portal's emSigner or the income-tax portal's emBridge if you'll file from inside the session. We also keep smart-card redirection allowed on the server. That's a Group Policy setting called "Do not allow smart card device redirection", and it stays off.

3. Smart cards ticked in your Remote Desktop app

Windows PC: Remote Desktop Connection

1. Plug the token in first.
2. Open Remote Desktop Connection (or right-click the .rdp file we sent you and choose Edit).
3. Select Show Options, open the Local Resources tab and, under Local devices and resources, select More…
4. Tick Smart cards and select OK. Tally's FAQ also lists Drives and Other supported Plug and Play (PnP) devices; tick them if your token's software asks for them.
5. Back on the General tab, select Save, then Connect.

If you connect with an .rdp file, the same switch is the line redirectsmartcards:i:1. Open the file in a text editor and check it ends in 1.

Mac: Windows App

1. Plug the token in and open Windows App.
2. Select Devices, find your Tally server and select the pencil (edit) icon on its card.
3. On the Devices & Audio tab, tick Smart cards. Steps per Microsoft's Windows App redirection guide.
4. Select Save and connect. You still sign in to the server with your password as usual; the token is used only inside the session.

Note that Windows App on macOS doesn't support general USB redirection, so smart-card redirection is the only route for a token from a Mac. Everything else about running TallyPrime on a MacBook is in our Tally on Mac guide.

Linux: Remmina

Remmina lists a Share smartcard option for RDP connections in its feature list. The Linux smart-card service (pcscd) must be running, and your token needs Linux support from its maker. Treat it as "test first". The rest of the Linux and Chromebook setup is in Tally on Linux and Chromebook.

Test it in 30 seconds

Inside the cloud session, open Command Prompt and run certutil -scinfo, the check Microsoft gives in its smart-card redirection guide. If redirection works, your token's reader appears in the list:

C:\> certutil -scinfo
The Microsoft Smart Card Resource Manager is running.
Current reader/card status:
Readers: 1
  0: <your token's reader name>
--- Status: SCARD_STATE_PRESENT
--- Status: The card is available for use.

Abridged and generalised from Microsoft's example output; your reader's name and status lines will differ.

Then confirm Windows can read the certificate, which is the check Tally recommends: search for Internet Options in the session, open the Content tab and select Certificates. Your DSC should be listed under Personal.

Signing invoices and reports in TallyPrime

TallyPrime has signed PDFs with DSC tokens since release 2.1. According to Tally's digital signature guide, you can add a signature while you print, export, e-mail or share a PDF on WhatsApp, and the steps are the same for each. Its help lists certificates from Certifying Authorities including eMudhra, Capricorn, (n)Code Solutions, Verasys, Safescrypt, Pantasign CA and IDSign CA.

1. Open the invoice or report and press Alt+E to export (or Ctrl+P to print, Ctrl+M to e-mail).
2. Press F8 (File Format) and choose PDF.
3. Under Digital Signature, pick your certificate from the list. Set Ask before signing to Yes if you want a confirmation each time.
4. Choose the signature format, Only Text or Text & Image, then export.
5. Enter the token's User PIN when prompted.

On invoices the signature appears with the date and time above Authorised Signatory. TallyPrime doesn't store your PIN, but it remembers it until you remove the token or restart TallyPrime. Over the cloud, disconnecting your session takes the token out of the session too, so expect to enter the PIN again when you reconnect. To sign many invoices at once, Tally's FAQ suggests printing, exporting or e-mailing them together as one batch.

Signing GST returns, e-invoices and ITRs

Filings can be signed in two places: inside TallyPrime, for GSTR-1, or on a government portal in a web browser, with a small signer program the portal asks you to install. For portal filings, the golden rule is that the signer and the token's driver must be on the computer that runs the browser. You can choose either computer.

• File inside your cloud session. Open the browser on the server, with the token redirected and the signer installed there. Your TallyPrime data, exports and the portal are all in one place, which suits CA firms whose staff prepare returns on the server.
• File from your own laptop. Export the JSON or Excel file from TallyPrime to a redirected folder, then upload and sign in a browser on your laptop, with the signer installed locally. This is the fallback when a token works on your laptop but not in the session.

GST returns

Tally's own GST guide notes that companies and Limited Liability Partnerships must use a DSC for authentication and return filing, while other taxpayers can file with EVC, a one-time password. Before your first DSC filing, register the certificate on the GST portal under Register / Update DSC, and install emSigner from the link on that page, choosing the download for your operating system.

Since release 5.0 you can also file GSTR-1 without opening the portal. Tally's GSTR-1 filing guide gives the route: Alt+Z (Exchange) › All GST Options › File GSTR-1, verify the summary, press S (Send), then D (Digital Signature Certificate), choose the signatory and enter the PIN when asked. On a cloud server this works only when your token is redirected into the session, which is exactly what the setup above gives you.

e-Invoices: no token needed

Good news: generating an e-invoice doesn't need your token at all. When TallyPrime sends the invoice to the Invoice Registration Portal, Tally's e-invoice guide explains that "the digitally signed e-invoice JSON along with QR code is sent to the supplier". The IRP signs it, not you. Your DSC comes in only if you also want the PDF copy of that invoice signed, using the TallyPrime steps above.

Income-tax returns and tax audit reports

The income-tax e-filing portal uses its own signer, emBridge. Its DSC registration guide lists the path as Download › DSC Management Utility › Utility (emBridge), with the token plugged in before you register under My Profile › Register DSC. Companies file their income-tax returns under a DSC, and so do many businesses whose accounts are under tax audit. Most individuals e-verify with Aadhaar OTP instead. The rules and section numbers are moving to the Income-tax Act, 2025, so confirm your category on the portal. Tax audit reports are signed and uploaded by your CA with their own DSC, usually from their own office. For the closing work that comes before any of this, see our TallyPrime year-end checklist.

emSigner fixes that work on a cloud server too

The GST portal's DSC troubleshooting guide covers the errors people hit most. They apply whether emSigner runs on your laptop or on your cloud server:

• "Failed to establish connection to the server. Kindly restart the emSigner". Stop emSigner and start it again with Run as administrator. On a server, ask us to do this if your login doesn't have admin rights.
• The browser blocks the signer. emSigner talks to the portal through a local address such as https://127.0.0.1:1585. Open that address in the same browser and accept the certificate warning, or add it as an exception, then retry.
• "The DSC you are trying to affix is not registered at the portal". Register or update the DSC on the portal first, and check that the certificate is PAN-based.
• Old emSigner version. Uninstall it and install the current one from the GST portal.
• Several people signing from one server. emSigner listens on a local port, so two copies running at once can clash. Sign one at a time, or restart emSigner before you start.

When to sign locally instead

Signing inside the session is convenient, but it isn't compulsory. Sign on your own computer when:

• You're on an iPad, phone or Chromebook. There's no route for a USB token from these devices. Prepare the return in TallyPrime on the go, then sign from a laptop, or use EVC or Aadhaar OTP if your business is allowed to.
• Your token has no driver for one end. If it works on your Windows laptop's browser but not in the session, file from the laptop while we look into the server driver.
• Only one person holds the token. In many firms, staff prepare and the partner or director signs. Staff can work in TallyPrime from anywhere, and the token holder signs from their own computer.
• It's the deadline and something misbehaves. Export the JSON from TallyPrime to a redirected folder and file from your laptop. Fix the session setup after the deadline.

Keep your DSC token safe

A Class 3 DSC can sign returns, forms and documents in your name, so treat it like a cheque book with your signature already on it.

• Unplug it when you're done. TallyPrime keeps the PIN until the token is removed or TallyPrime restarts, so a token left in the laptop stays ready to sign.
• Never share the PIN, and never write it on the token or in a file on the server.
• Don't leave it in a shared office PC. Anyone using that PC's Remote Desktop session could ask it to sign.
• Keep the certificate current. Check its expiry date before filing season. TallyPrime only warns when you pick an expired certificate, but the portals won't accept one.
• Give every staff member their own login. Two-factor sign-in, separate Windows accounts and access logs are covered in how we secure Tally on Cloud.

Troubleshooting: DSC token not detected in Remote Desktop

Work down this table before you call anyone. Most fixes take a minute.

Still stuck? Message TallyoCloud support with your device, the token's make and model, and a screenshot of the error. Support 7 days a week. If you haven't moved yet, test your token and your filing routine before you commit, ideally weeks before a deadline. Smart-card redirection sits alongside printing, backups and multi-user access in our Tally on Cloud features.

Frequently asked questions

Sources we checked

All sources were checked on 2026-10-06. If something has changed, tell us and we'll correct it.

• Microsoft Learn: Compare Windows App features across platforms (smart-card, USB and port redirection by platform)
• Microsoft Learn: Redirect local devices in Windows App (Mac steps; YubiKey preview on iPhone and iPad)
• Microsoft Learn: Configure smart card redirection over RDP (policy setting and the certutil -scinfo test)
• Tally Solutions: Digital signature in TallyPrime and Digital signature FAQ (cloud, RDP, PIN and certificate rules) and File GSTR-1 using TallyPrime
• Tally Solutions: DSC, e-Sign and EVC on the GST portal and How to generate e-invoices
• Income Tax Department: How to register DSC (emBridge utility)
• Remmina: Remmina features (smart-card sharing on Linux)