KSeF token loses its expiry date: what this changes for implementation

The Ministry of Finance has dropped the plan under which a KSeF, Poland's National e-Invoicing System, token as an authentication method would only work until 31 December 2026. For companies that already set up their KSeF access, that is good news: nothing needs replacing when the new year starts. We write up what this means for clients who chose a token, and for those who chose a certificate instead.

What changes: the KSeF token loses its expiry date

The earlier announcement set an end date for tokens at the close of 2026. The ministry has withdrawn that plan. A generated token now stays valid until the user cancels it themselves, with no fixed expiry date attached.

The ministry reserves the right to introduce periodic token renewal in future for security reasons, but names no date for it. That is a notice for later, not a decision that needs factoring into an implementation plan today.

Tokens and certificates run side by side, not instead of each other

Besides tokens, KSeF 2.0 also allows certificates: type 1 for authentication, and type 2 for issuing invoices in offline24 and emergency modes, with a QR code that lets a recipient verify who issued the invoice. A certificate is valid for a maximum of two years from the date it was created, so it needs renewing after that. Both methods can run at the same company at the same time, each for its own purpose.

2027 on its own does not force a switch from a token to a certificate. With our clients this question kept coming back, because the earlier 31 December deadline suggested something had to change at the turn of the year. That pressure is gone now.

What this changes in our implementation advice

For new implementations we still recommend a token wherever plain authentication in SaldeoSMART is enough, and a certificate wherever a client issues invoices in offline24 mode or wants a fallback path for a system outage. That choice always came from what the company actually needed, not from an expiry date, so we are not changing it.

For companies that already have a token set up, we do not suggest switching to a certificate just because 2027 is approaching. The one thing we do check again with such clients is who in the company generated the token and where it is kept, because that person, not us and not the vendor, is the one who can cancel it.

Starting point: a post on the vendor's blog, "Token KSeF bez terminu końcowego. Co zmienia się po 2026 roku?" (14 October 2026). The assessment and the implementation advice are ours.

The facts in this post come from an announcement by SaldeoSMART, the vendor. The assessment, examples and practical notes are ours.