Overview
A KSeF token is an authentication credential with a validity period, and when it expires your integration can no longer open sessions or submit invoices. The routine that keeps you running is simple: check the expiry date, generate a new token before the old one dies, and replace it in one place — Connect KSeF in Notaly.
What the token is (and what it is not)
KSeF (Krajowy System e-Faktur) is Poland's national e-invoicing platform. Before you can send a FA(3) invoice, your system authenticates and opens an online session. The token does that job: it is encrypted together with the challenge timestamp using the Ministry of Finance public key, and that opens the session. It is an authentication credential, not a signing key — the invoice XML itself is encrypted and sent, never signed with the token. XAdES with a qualified signature or seal is the alternative authentication path.
Why expiry matters
A token is issued with a validity period set at the moment of creation. There is no self-renewal: when it lapses, authentication fails and submissions stop. The failure can be silent until you actually try to send an invoice, which is the worst moment to discover it. Treat the expiry date as a calendar event, not something you notice in production.
A rotation routine that works
- Find the expiry date. The KSeF portal shows it when you generate the token; record it somewhere your team looks.
- Generate a new token early. Do not wait for the last day. Prepare the replacement while the old token is still valid.
- Replace it in one place. In Notaly you paste the new token in Connect KSeF, in Settings. The change applies to every submission from then on.
- Test once. After rotating, send a single test invoice and confirm it reaches submitted and then accepted, so you know the new token actually opens a session.
- Revoke the old one. If the portal lets you revoke the old token, do so once the new one is confirmed, so a stale credential cannot linger.
Where Notaly helps
Notaly holds the token you provide and uses it to authenticate each submission for you, so you are not wiring challenge timestamps and session renewal into your own code. You still own the token lifecycle — generating and replacing it — but the mechanics of using it are handled. If a submission fails because authentication is broken, the result is surfaced so you can act, rather than vanishing.
FAQ
Is the KSeF token a signing key? No. It is an authentication credential. It opens the session; the invoice XML is encrypted and sent, not signed with the token.
What happens when the token expires? Authentication fails, so new sessions cannot be opened and submissions stop until you provide a valid token.
Disclaimer
Notaly is not a tax, accounting or legal advisor. This article is general information, not tax advice, and may be outdated. You are responsible for your own VAT compliance; confirm with a qualified accountant where required.
Sources
Source: www.podatki.gov.pl