KSeF permissions for an accounting firm: who holds them and how we set them up

Reading invoices and issuing them are two separate rights, so one can be granted without the other.

Who can hold KSeF permissions

An entity with a qualified electronic seal gets KSeF access as soon as it authenticates. Most companies have no seal, so they start with the ZAW-FA form, filed on paper or through the e-Urząd Skarbowy portal. The form names a natural person who will manage the company's KSeF account. Only once the tax office has registered that ZAW-FA does the named person log into the Aplikacja Podatnika (Taxpayer Application) and start granting permissions onward.

A taxpayer can appoint a named person or an external accounting firm to manage permissions from the outset. Entities with a NIP, such as accounting firms, can be granted permissions with the option of passing them on to their own staff. This distinction matters: the permission lands on the firm, and the firm decides which of its accountants actually uses it.

Employees are identified by their PESEL number or NIP. Most are given only one of the two rights: issuing structured invoices, or reading them, with no administrative powers. A branch manager can get an administrator role limited to their own team rather than the whole company.

How we set up an accounting firm's permissions during implementation

For a company implementation we usually start with ZAW-FA, because without it nobody at the company can grant further permissions. The form can be filed on paper or through e-Urząd Skarbowy, but registering it at the tax office takes time. Once the form is registered, the named person logs into the Aplikacja Podatnika and grants access to invoices to the accounting firm that keeps the client's books, usually without issuing rights, unless the client wants the firm to issue invoices on its behalf.

The token is a separate matter: it connects SaldeoSMART to the KSeF platform and is generated after logging in, regardless of who holds which permission. A company served by an accounting firm enters two tokens in the software: its own and the firm's, so the firm can send and fetch documents on its behalf. A company with in-house accounting sets the token at the main account level or the company level, depending on how its staff log in. We wrote separately about the Ministry of Finance dropping the token's expiry date in our post on the KSeF token losing its expiry date, because that is a separate decision from who gets access.

A sole trader never has to grant permissions to themselves. The system assigns them automatically by NIP, so we skip that step entirely.

The common mistake: a permission on a person, not on the firm

A client files ZAW-FA, then grants access to one named person at the accounting firm instead of to the firm itself with the option to pass it on to staff. Nothing shows while that person stays at the firm. The problem surfaces when they change jobs or move to a different role: the client's invoice access stays tied to someone who no longer handles the account, and the firm has to ask the client to grant permissions from scratch.

There is a nuance worth knowing here: taking away someone's right to manage permissions does not remove the access that person already granted to others. So if the permission went to the firm as an entity, with the option to pass it on, one person leaving the firm does not touch the rest of the team's access. The problem only appears when that one person held the permission personally.

During implementation we check who actually holds the permission before the first invoice goes through SaldeoSMART. If we see it granted to a named person instead of the firm, we tell the client directly and suggest fixing it before a staffing change at the firm turns into an access gap.

Source: SaldeoSMART blog post "Nadawanie uprawnień w KSeF" (August 2026, in Polish). Commentary and implementation examples: Forgante.