KSeF token or certificate: token validity after 2026 and permissions

A KSeF token is a string you enter in your accounting software so that it connects to KSeF (Krajowy System e-Faktur, the national e-invoicing system) within the permissions chosen when the token was generated. A KSeF certificate only proves identity: type 1 logs the software in, type 2 marks offline invoices with a second QR code, and each is valid for 2 years at most.

Law as of 1 November 2026.

Neither a token nor a KSeF certificate logs you in to the free Aplikacja Podatnika KSeF (the Ministry's KSeF taxpayer app). There you log in through login.gov.pl (Profil Zaufany, mObywatel, online banking, e-ID card) or with a qualified signature or seal. Tokens and KSeF certificates are for software that connects to KSeF through the API.

Token and KSeF certificate in one table

Legal basis: § 6 ust. 1 and 2, § 9 ust. 10 and § 13 of the regulation of the Minister of Finance and Economy of 12 December 2025 on using KSeF (Dz.U. 2025 poz. 1815 as amended) and the draft amendment of 26 October 2026.

Does a KSeF token work after 2026?

Under the regulation in force, token authentication is allowed until 31 December 2026 (§ 13 ust. 1 pkt 1). The Ministry of Finance announced that tokens will stay in KSeF, and on 27 October 2026 it published a draft amendment of the regulation at the Government Legislation Centre (RCL). The draft is at the inter-ministerial and consultation stage; it is not yet signed or published in the Journal of Laws (Dziennik Ustaw).

What the draft changes:

1. The token becomes a permanent login method. A new § 6 ust. 1 pkt 5 adds the KSeF token to the authentication methods, next to signatures, seals, the national login node and the KSeF certificate.
2. Tokens generated before 1 January 2027 work until 30 November 2027 at the latest. This provision is to enter into force on 31 December 2026, one day before the current end date for tokens.
3. A new token is valid for 365 days at most from generation or from a start date you choose. The period counts in calendar days.
4. A KSeF certificate can be limited to one NIP (tax number) or to a branch identifier, without changing the permissions themselves.

In practice: a token you generate today will, under the draft, serve until 30 November 2027. By that day you replace it with a new token that has an expiry date, or with a type 1 KSeF certificate. Many guides still say tokens disappear at the end of 2026, or that they stay with no end date at all; the draft says something else.

A KSeF certificate is not a one-to-one replacement for a token. The Ministry stresses that the two are not functionally equivalent: a token carries permissions, while a certificate is only a way to authenticate, like a qualified signature.

Where each login method works

Login through the national node works since 14 February 2026 (the regulation as amended by Dz.U. 2026 poz. 169). If you log in with a token, you cannot generate a KSeF certificate (§ 13 ust. 2), so for a certificate you log in with a signature, a seal, the national node or another KSeF certificate.

Permissions in a sp. z o.o.

First, someone in the company needs owner permissions. Only that person grants further permissions, generates tokens and requests certificates.

1. A company with a qualified seal carrying the company's NIP logs in with it and has full owner permissions at once. It files nothing with the tax office.
2. A company without a seal files the ZAW-FA(3) notice with the head of the tax office: on paper, through the form in e-Urząd Skarbowy (the online tax office) or through e-Doręczenia (the e-delivery service). Since 1 January 2026, a ZAW-FA sent through ePUAP is not validly delivered.
3. ZAW-FA names one natural person, who need not be a management board member. That person gets permission management, invoice issuing, invoice access and management of subordinate units. The office enters the notice into the system promptly after receiving it.
4. Further permissions are granted by that person electronically in Aplikacja Podatnika (menu "Nadaj uprawnienie", grant permission) or in the accounting software. No further ZAW-FA is needed.
5. Changing the ZAW-FA person takes two notices: revoking person A's permissions and granting person B. Permissions that person A granted to others remain.

Legal basis: § 4 and § 5 of the regulation on using KSeF.

Types of permissions

Issuing invoices and access to invoices are two separate permissions. You can give your accountant only access to invoices and a salesperson only issuing (§ 3 ust. 1 of the regulation).

Permissions for an accounting office

The company grants the permission to the whole office by its NIP, not to each employee separately (§ 3 ust. 3 of the regulation). If it ticks onward delegation, the office itself names the employees who serve the company. When the office's accountant changes, the office updates the permissions and the company does nothing. What else to agree with the office is in the article how much an accounting office costs for a sp. z o.o..

How to generate a KSeF token

1. Log in to Aplikacja Podatnika KSeF through login.gov.pl or with a qualified signature or seal, in the context of the company's NIP.
2. Choose "Generuj token" (generate token) in the menu.
3. Enter a token name, for example "Accounting software", and tick the permissions: issuing invoices, viewing invoices, viewing permissions, managing permissions, managing subordinate units or viewing session history.
4. Click "Generuj token" and copy the token at once. The app shows it only once.
5. Paste the token into the software. The token list and the "Unieważnij" (revoke) button are under "Lista tokenów".

Five rules that are easy to forget:

• A token cannot be updated. When you need a different scope, you generate a new one.
• Revoking a person's permissions also removes them from that person's tokens, but the token does not disappear. Once the permissions are granted again, it works again.
• A token works only in the context where it was generated: a token from your own NIP does not log you in to the company, and the other way round.
• You cannot put a permission in a token that you do not hold yourself.
• A token generated by a natural person may not be passed to another person. A token generated by a company after logging in with its seal may be handed to staff, and KSeF then shows the company's data.

How to get a KSeF certificate

1. Log in to Aplikacja Podatnika KSeF and choose "Wnioskuj o certyfikat" (request a certificate). The certificate gets the identifier you logged in with: your PESEL or NIP, or the company's NIP after logging in with the seal.
2. Enter a certificate name (5 to 100 characters) and a private-key password (15 to 32 characters, upper and lower case, a digit, a special character). The password cannot be reset.
3. Click "Generuj" (generate). The private key is saved on your device as a .key file.
4. Choose the purpose: "Uwierzytelnienie w systemie KSeF" (authentication, type 1) or "Podpis linku weryfikacyjnego wystawcy" (signing the issuer's verification link, type 2, for offline invoices). One certificate cannot have both purposes.
5. Set the start of validity and send the request. Once issued, download the certificate under "Lista certyfikatów".

A certificate issued to a natural person must not be shared with anyone. A certificate issued to a company is not tied to a person, so the company may hand it to staff, but it is responsible for recording its download, handover and revocation.

KSeF certificate limits

You can get a new certificate one month before the oldest active one expires (KSeF 2.0 manual, part I, point 2.5.6).

Example: a company without a seal and an accounting office

A sp. z o.o. has no qualified seal. The board signs ZAW-FA and names the CEO in it. The CEO logs in with Profil Zaufany in the context of the company's NIP and does four things:

1. Grants the accounting office access to invoices with onward delegation. The office names its accountant.
2. Grants a salesperson permission to issue invoices on their PESEL.
3. On 2 November 2026 generates a token with issuing and viewing invoices for the company's accounting software. Under the MF draft this token works until 30 November 2027 at the latest.
4. On the same day requests a type 2 KSeF certificate with a validity start of 1 December 2026. The certificate works for 2 years, until 30 November 2028, and the CEO can get the next one a month before it expires.

Result: three people and one program use KSeF, and the ZAW-FA had to be filed only once.

How Norman helps

Norman sends the company's invoices to KSeF and pulls sales and purchase invoices from it. You connect it with a KSeF token in three steps, described in the KSeF token guide, and then work in one place. You use Norman 30 days for free with no card, and KSeF in Norman stays free after the trial; the VAT register, VAT-UE and JPK_V7, which you approve, are in the Max plan at 119 zł net a month. A single invoice without an account takes a minute in the KSeF invoice generator, and more about Norman is on the home page.

The other KSeF duties of a company are in the article KSeF for a sp. z o.o., and the deadlines for sole traders in KSeF from 1 January 2027 for sole traders and small businesses.

Frequently asked questions

Will a KSeF token expire on 31 December 2026?

The regulation in force still gives that date. The MF draft of 26 October 2026 extends tokens generated before 2027 to 30 November 2027, and new tokens will be valid for 365 days at most. The draft is not yet published.

Can I log in to Aplikacja Podatnika KSeF with a token?

No. You log in to Aplikacja Podatnika through login.gov.pl or with a qualified signature or seal. Tokens and KSeF certificates are for software that connects to KSeF through the API.

What is a type 2 KSeF certificate for?

For invoices issued offline: an invoice handed to the buyer before it has a KSeF number is marked with the "OFFLINE" QR code and a second "CERTYFIKAT" code, which needs a type 2 certificate (§ 9 ust. 10 of the regulation).

How many tokens can a company have?

KSeF does not limit the number of tokens. You can have one token for all permissions or a separate one for each.

Does the accounting office need a ZAW-FA from the company?

No. ZAW-FA only names the first person of a company without a qualified seal. The office gets its permissions electronically, from that person or from the company logged in with its seal.