KSeF token and permissions: how to log in to the system
Choose who needs to log in to KSeF. The tool shows the right method, any notifications needed and the dates. The login itself always happens on the ministry’s site.
You log in with
Trusted profile or e-ID (national node), qualified signature
You hold every permission straight away.
| ZAW-FA notification | no |
| Tokens generated in KSeF 1.0 | work until 31 December 2026 |
| KSeF certificate available | since 1 November 2025 |
Sections 5, 6 and 13 of regulation 2025 item 1815; you always log in on the Finance Ministry’s site, never through this one.
Prepared by Radif Partners · Method · VAT Act, regulations and ministry notices checked on 25 October 2026
A person or a program logs in to KSeF, and every access rests on permissions. A sole trader gets in straight away, with the trusted profile or an e-ID card through the national login node, or with a qualified signature, and holds every permission. A company logs in with a qualified e-seal or, without one, through a person named in a ZAW-FA notification filed with the tax office, under section 5 of the regulation on using KSeF. That person then grants permissions to others: employees, an accountant, software. Software connects through the API with a KSeF token or a KSeF certificate, available since 1 November 2025 and valid for at most 2 years. Tokens generated back in KSeF 1.0 work until 31 December 2026. The old trusted-profile login ended on 13 February 2026. This page is not a login page and never asks for a password, token or certificate.
Login methods
| Who | Logs in with | Notification |
|---|---|---|
| sole trader | trusted profile or e-ID (national node), qualified signature | no |
| company with an e-seal | qualified e-seal | no |
| company without an e-seal | person named in ZAW-FA, own login | ZAW-FA at the tax office |
| accountant, employee | own profile, signature or certificate | permission from the business |
| software (API) | KSeF token or certificate | permission from the business |
The rules are in the regulation on using KSeF and its amendment 2026 item 169, which cut short the old trusted-profile method. Check your case in the mini tool:
You log in with
You log in with
Own trusted profile, signature or KSeF certificate
| ZAW-FA notification | no |
| Tokens generated in KSeF 1.0 | work until 31 December 2026 |
| KSeF certificate available | since 1 November 2025 |
KSeF certificates
Since 1 November 2025 the certificates and permissions module has been running. The system issues two kinds of certificate: for authentication, which software uses to log in instead of a token, and offline, used to sign CODE II on invoices issued without a connection. A certificate is valid for at most 2 years, and the private key stays with you. Details are on the certificates page.
Permissions
Permissions are separate for issuing invoices, viewing invoices and managing permissions; they can be granted to a person, a business or software and withdrawn at any time. The ministry describes them on its page on permissions and authorisation. Good practice: the accountant gets only what they need, and software gets its own token rather than your login.
Try a new token in the test environment first. The differences between system versions are covered under KSeF 2.0, and the offline certificate under offline modes.
How to store a token and certificate safely
Treat a token and a certificate’s private key like a bank password. Do not send them by email, do not keep them in a spreadsheet shared with others, and do not enter them on websites that promise help with KSeF. Each piece of software should have its own token with permissions limited to what it needs, for example only downloading purchase invoices. That way, if one token leaks, you revoke only that one and the other programs keep working.
Once a year it is worth reviewing the list of permissions and tokens granted: removing those nobody uses any more, checking certificate expiry dates and making sure the accountant has access only to what they need. The review takes a few minutes and closes the most common gaps.