KSeF Certificates vs Tokens: What Stays After 2026

KSeF tokens do not end on 31 December 2026, and you do not have to move to certificates to keep sending invoices. The Ministry of Finance, which runs KSeF (Poland's national e-invoicing system), answers the question directly in its FAQ: it decided to keep tokens as a sign-in method in KSeF 2.0 without an end date. Certificates are a second method that works in parallel. A certificate becomes necessary for one job in particular: issuing invoices in offline mode.

This page is for the IT or finance lead who has heard that tokens are ending and wants to know what to do. It sets out what the Ministry has said, what a KSeF certificate is, the two types, who can apply, and the questions to put to a software provider. Qualified electronic signature set-up is not covered. GoRoute is a certified Peppol Access Point and SMP (POP000991). Its KSeF pack sends invoices to KSeF production and keeps the KSeF number and the UPO receipt (KSeF's signed proof of acceptance).

Do KSeF tokens end in 2026?

No. The Ministry's questions-and-answers page, last changed on 8 October 2026, asks: "Will the option to use tokens as an authentication method in KSeF 2.0 expire at the end of 2026?" Its answer is "No". It says that, listening to businesses and software providers, it decided to leave this method in KSeF 2.0 for an unlimited time, and that the regulation on using KSeF will be amended accordingly.

We found no official statement that tokens end on 31 December 2026. The question comes up because the date was once attached to them: the Ministry's 9 June 2026 consultation proposed keeping tokens "also after 31 December 2026", which suggests, as our inference, that the date mattered in earlier plans. The same summary adds two proposals for how tokens would work:

• a validity period of 1 to 365 days, set when the token is made;
• a new permission that could, with the owner's consent, renew a token automatically.

Those two are proposals from a consultation, not rules. The FAQ says a token stays valid "under current assumptions" until the user revokes it. We have not seen the amended regulation. If you build a process around token lifetimes, check the Ministry's page before you do.

What is the difference between a token and a certificate?

Both let software act in KSeF without a person signing in each time. They differ in how they are made and what else they can do.

Two details from the technical documentation matter in practice. A token's permissions cannot be changed: a different set needs a new token. A certificate carries no permissions at all. KSeF checks what the signed-in party may do, in the context chosen at sign-in, so one certificate can be used in several contexts, with a different scope in each.

What are type 1 and type 2 certificates?

Type 1 signs you in. Type 2 proves who issued an offline invoice. The Ministry's FAQ puts it this way: a type 1 certificate is for authentication in the system. A type 2 certificate is required when issuing invoices in the special offline modes, offline24, offline for KSeF maintenance, and emergency mode. It lets the invoice handed to a buyer outside KSeF carry a QR code that proves the issuer's identity.

The technical documentation names the same two types Authentication and Offline. Each certificate has one type only, so a business that needs both asks for two. An Authentication certificate cannot generate the second QR code (KOD II), and an Offline certificate cannot sign in. KSeF offline modes explains the two QR codes and when each mode applies.

Who can apply for a certificate, and how?

The person or company that will use it, in its own name. The application data are read from the credential used to sign in when applying, and a request that changes them is rejected.

The Ministry lists who may apply without extra conditions:

• natural persons named in the ZAW-FA notification (the form that names who acts for a business);
• natural persons with owner permissions;
• companies that are not natural persons, with owner permissions and a qualified electronic seal.

Where the person or seal has no NIP or PESEL, the certificate can be issued to the fingerprint of the credential used.

The route has moved. From 1 November 2025 the application was made in the Certificates and Permissions Module (MCU). Since 1 February 2026 the same functions have been available in the Taxpayer Application (Aplikacja Podatnika KSeF) and in commercial programs integrated with KSeF's 2.0 interface. The technical documentation says an application cannot be made while signed in with a KSeF token: a qualified signature or seal, or Trusted Profile for a natural person, is needed. It also says a certificate issued by KSeF can be used to sign in to apply for another.

Who may use a certificate once it is issued?

It depends on whom it names. The Ministry's answers are plain on this:

• A certificate issued to a sole trader is personal. The sole trader cannot hand it to an accountant. The accountant needs permissions granted in KSeF instead.
• A certificate issued to a company is not tied to one employee. The company may pass it to chosen staff, and it remains responsible for registering, controlling, sharing and revoking it.

The Ministry's module page asks businesses to treat certificates like online banking credentials or payment cards, because anyone who holds one can issue and receive invoices in your name. It also asks for clear internal rules on downloading, passing on, using and revoking them.

One more rule is easy to miss: in production, only keys, certificates and tokens created in production work. The Ministry reminded integrators of this in January 2026 after seeing test credentials used in production.

What should you ask your software provider?

Ask five questions, and keep the answers. They matter more now that the date is close.

1. Which sign-in method do you use for my KSeF connection, token or certificate? The Ministry says both are valid and run in parallel.
2. Where is the secret stored, and who can read it? Token or certificate, it lets software act as you.
3. Do you issue invoices in offline modes? If yes, ask where the Offline certificate is held and who applies for it. If no, ask what your plan is when KSeF is down. Free Ministry tools do not offer an offline mode.
4. What happens when a token or certificate is revoked or expires? Ask whether invoices wait and are sent later, or are lost.
5. If the token rules change, will you tell me? The amended regulation is still to come.

For GoRoute, the KSeF setup reference describes connecting a KSeF token that has the InvoiceWrite and InvoiceRead permissions, and says an invoice waits and is sent once a usable token is connected. We do not describe any other sign-in method on that page, so ask us if you need one.

What to do next

If your software signs in with a token, you can keep it, but note the review dates in your own diary. If you plan to issue offline invoices, apply for an Offline certificate before you need it. Read KSeF in 2027: what changes on 1 January for the dates that do change, and KSeF for foreign companies if you invoice from abroad.

To see how GoRoute connects to KSeF, read the Poland e-invoicing page and the KSeF setup reference, then book a demo or watch the tutorials.

Related reading

• KSeF in 2027: what changes on 1 January, the dates and penalties.
• KSeF offline modes: offline24, outages and emergency mode, where the second certificate is used.
• KSeF for foreign companies, who must issue.
• Poland KSeF 2026: migration path for Peppol-first architectures, the first two waves.

Sources, all read on 5 November 2026: Ministry of Finance, KSeF website, Pytania i odpowiedzi KSeF 2.0 (changed 8 October 2026), question 39 on tokens and the section on KSeF certificates; Pierwsze konsultacje po częściowym wdrożeniu KSeF (11 June 2026); Moduł Certyfikatów i Uprawnień; Uprawnienia i autoryzacja; Przypominamy o zasadach poprawnego korzystania ze środowiska produkcyjnego (29 January 2026); and the Ministry's technical documentation, certyfikaty-KSeF and tokeny-KSeF. This is not tax or legal advice.