Overview
KSeF accepts two ways to authenticate a session: a KSeF-issued token, or an XAdES signature made with a qualified signature or seal or a KSeF certificate. They are alternatives for the same step — proving who you are before you send an invoice — and in both cases the invoice XML itself is not signed: it is encrypted and sent in the online session. Notaly uses the token, so you do not need a qualified seal.
The role of authentication
KSeF (Krajowy System e-Faktur) is Poland's national e-invoicing platform operated by the Ministry of Finance (Ministerstwo Finansów). Before your system can submit a FA(3) invoice it must open an authenticated session. Authentication is separate from the invoice: it answers "who is allowed to submit for this taxpayer", not "who signed this document".
The token path
A KSeF token is a credential you generate in the KSeF portal or via the API. To open a session, the token is encrypted with the Ministry of Finance public key together with the challenge timestamp. That proves the credential without a qualified seal, which is why the token is the lighter integration path.
The certificate / XAdES path
The alternative is to sign the authentication challenge with XAdES, using a qualified signature or qualified seal — or a KSeF certificate. This is the path for organisations that already hold a qualified seal and want to use it. It authenticates the session, not the invoice: the invoice XML is still encrypted and sent in the session, not signed.
Why the invoice is not signed
A common confusion is to think the FA(3) document must be signed. It does not. The invoice is encrypted (AES-256, with the key wrapped by the Ministry's public key) and sent in the authenticated session. What must be authenticated is the session itself, and that is exactly what the token or the XAdES signature does.
Which one to choose
If you already own a qualified seal and a team that handles XAdES, the certificate path is natural. If you want the fastest route, the token is simpler and does not require a seal. Notaly takes the token path: paste it once in Connect KSeF and Notaly authenticates every submission for you.
FAQ
Is the invoice signed with the token? No. The invoice XML is encrypted and sent in an online session; the token only authenticates the session.
Do I need a qualified seal to use KSeF? Not with a token. A qualified signature or seal is the alternative, XAdES-based way to authenticate the session.
Disclaimer
Notaly is not a tax, accounting or legal advisor. This article is general information, not tax advice, and may be outdated. You are responsible for your own VAT compliance; confirm with a qualified accountant where required.
Sources
Source: www.podatki.gov.pl