KSeF tokens after 2026: what we know

The regulation in force lets you authenticate to KSeF (Krajowy System e-Faktur, Poland's national e-invoicing system) with a token only until 31 December 2026. The Ministry of Finance (MF) and the KSeF API team say tokens will stay in use, but as of today the regulation has not been changed.

What exactly expires on 31 December

§ 13 ust. 1 pkt 1 of the regulation on using KSeF allows authentication with an "alphanumeric string" (a token) until the end of 2026. The permanent methods are listed in § 6 ust. 1: the national node of electronic identification, a qualified signature, a qualified seal and a KSeF certificate. Tokens are not on that list. Dz.U. 2025 item 1815

Tokens from the old KSeF 1.0 are not compatible with KSeF 2.0, so the deadline concerns tokens generated for KSeF 2.0, in the Taxpayer Application (Aplikacja Podatnika) or through the API. MF FAQ, question 35 The provision points to a definition in the 2021 regulation and never says "KSeF 2.0 token". The KSeF 2.0 Handbook, however, treats these same tokens as covered by the 31 December 2026 date.

What has been announced, and what does not exist yet

At the consultations on 9 June 2026 MF proposed keeping tokens after 31 December, with a validity period of 1 to 365 days and a new permission to renew a token automatically with the owner's consent. consultation summary

In the August edition of the KSeF 2.0 Handbook, part I (p. 26), MF went further: it "decided to keep this method of authentication for an indefinite period" and wrote that the regulation "will be amended accordingly". KSeF 2.0 Handbook, part I

On 10 September 2026 the team responsible for the KSeF API specification wrote in the official API repository that it is technically preparing to issue tokens under new rules from 1 January 2027. Tokens issued up to 31 December 2026 will still work for authentication, but their validity will be limited to 30 November 2027. The current token-creation endpoint is to run in "compatibility mode" and issue tokens with a limited lifetime, a new version of it will appear alongside, and the token format stays the same. The OpenAPI specification is not published yet. CIRFMF/ksef-api, issue 834 The same author added that the decision to retire tokens is written into the regulation, so changing it requires a change of the rules, and that formal communication belongs to MF. comment of 17 July

All of this is announcements, not law: the law is § 13 as it stands. We do not know:

• what the amendment will say and when it takes effect,
• whether token validity (today a token works until revoked), automatic renewal and the 30 November 2027 date will make it into the regulation or an MF notice,
• what the system will do on 1 January 2027 if the amendment is late. With § 13 as it stands, tokens are not permitted by the regulation from that date.

What to do now

Accounting offices. Pani Krystyna should check which of her clients' programs log in to KSeF with a token. The Taxpayer Application lists generated tokens under "Lista tokenów". Taxpayer Application manual, ch. 5.6 It is also worth asking the software vendor whether it supports KSeF certificates and what it plans after 31 December. A token generated by a natural person (for example a sole trader) may be used only by that person, so an office cannot use a token generated by a client. KSeF 2.0 Handbook, part I, p. 38

For integrators

Marek, whose integration authenticates with a token, should not wait for the amendment. We suggest adding authentication with a type 1 KSeF certificate next to the token and hiding both behind one interface. Then the 1 January date does not force a rewrite. The API team says the aim is to get through 2026/2027 without touching integrator code, but tokens will get an expiry date, so you will need renewal handling either way.

KSeF 2.0 Handbook, part I, table 3 and ch. 2.5

Renew a certificate before it expires: a new one can be issued a month before the oldest active one lapses. You request it in the API or the Taxpayer Application after logging in with the national node, a qualified signature or a qualified seal. A token login cannot generate a certificate (§ 13 ust. 2), so you need one of those three.

For a comparison of all login methods see KSeF certificates vs tokens, and for what else to prepare before 2027 see the KSeF preparation checklist. We will update this post when an amendment to § 13 appears in the Dziennik Ustaw.