KSeF token or certificate: how to log in (2026)

If you issue invoices by hand in the Aplikacja Podatnika (the taxpayer web app of KSeF, Poland's National e-Invoicing System), log in with Profil Zaufany, Poland's free trusted identity profile. If software sends your invoices (Fakturownia, inFakt, wFirma, your own ERP), it connects through the API and needs a token or a KSeF certificate. Profil Zaufany does not work there.

Login methods at a glance

Profil Zaufany and e-ID card: manual login

If you've filed a PIT return online or logged in to ZUS (social security), you probably already have Profil Zaufany. If not, you can set it up in a few minutes through online banking, the mObywatel app, ePUAP (pz.gov.pl) or at a tax office.

It gives full access to the Aplikacja Podatnika: issuing invoices through a form, browsing invoices from your contractors and granting permissions to others, such as your accounting office.

The e-ID card works the same way if it's activated for electronic signatures (a one-off visit to an office). Most people choose Profil Zaufany because it needs no card reader. You can also log in to the Aplikacja Podatnika through mObywatel or online banking, and with an e-ID card through login.gov.pl.

Qualified signature and seal: if you already have one

A qualified electronic signature (eIDAS standard) comes from commercial providers such as Certum, Sigillum and EuroCert on an annual or multi-year subscription. In KSeF it gives the same browser access as Profil Zaufany, so it only makes sense if you already use it for e-KRS, public tenders or contracts.

A qualified seal is the legal-entity counterpart of the signature and is also a login method for KSeF.

Token: the simplest access for software

A token is a string you generate in the Aplikacja Podatnika and enter in your software's settings. It needs no certificate infrastructure. It works until revoked, has a scope (for example issuing only, or read-only), and you can revoke it with one click if you switch software providers.

Under the current regulation, tokens can be used until 31 December 2026. The Ministry of Finance has announced that tokens will stay longer and that it intends to amend the regulation. As of 7 October 2026 the change has not been made.

MF — summary of consultations after the partial KSeF rollout

KSeF certificate: type 1 (authentication) and type 2 (offline)

A certificate is a more durable credential for API access, downloaded from the MF system. It suits complex deployments serving many taxpayers better than a token does. The types differ by function, and one certificate has exactly one type:

• Type 1 (Authentication in the API) is for authenticating to KSeF.
• Type 2 (Offline in the API) is for issuing invoices in offline mode.

So an accounting office or integrator has no certificate type of its own. Who may act, and for whom, comes from the permissions granted in KSeF.

KSeF 2.0 Handbook, Part I, p. 14 CIRF — KSeF certificates (ksef-docs)

Permissions for your accountant, and when ZAW-FA is needed

You grant permissions, including those for an accounting office, electronically in the Aplikacja Podatnika KSeF 2.0 or through the API. This is the standard route. A ZAW-FA filed at the tax office is needed only when the taxpayer is not a natural person and has no qualified seal, or when the signature or seal does not contain a NIP or PESEL.

You set the scope yourself: read-only, issue-only or full access. Agree it with your accountant and grant no more than needed. Accounting offices usually ask for the permissions themselves and walk you through it.

MF regulation, Journal of Laws 2025, item 1815, §4–5 KSeF 2.0 Handbook, Part I, §3.2.3 MF FAQ — permissions and certificates

What to choose in your situation

If you invoice only occasionally, you can also look at e-mikrofirma, a free MF application for the smallest businesses. Its KSeF support is limited and changes, so check the MF site before relying on it.

We cover the rest of the preparation in KSeF from 1 April 2026. To check an XML file before sending it, drop it into the ksefuj.to validator; it runs in your browser and the file never leaves your computer.