5 KSeF 2.0 Authentication Methods: Which One Is Right for You?

First, one distinction that decides everything

KSeF has two access modes, and they determine which method makes sense for you.

Manual mode means logging in through a browser to the Aplikacja Podatnika (the taxpayer web app) and issuing invoices yourself. For this, a Profil Zaufany (trusted identity profile) or a qualified signature is enough.

Automatic mode is when your invoicing software sends the invoice by connecting to KSeF through the API. Here the Trusted Profile alone is not enough for steady work: a session opened with it does not renew itself, and the software needs a lasting way to authenticate, which is the KSeF certificate. (Biurko can connect with a Trusted Profile signature, but you sign the XML again each time the session ends.)

If you issue a handful of invoices a month by hand, look at the first group. If you use accounting software or integrate KSeF with an ERP, look at the second.

Method 1: Profil Zaufany (Trusted Profile)

The most popular option and it's free. You set it up once, for example through online banking, and use it the same way you handle other government matters. For a JDG (jednoosobowa działalność gospodarcza, sole proprietorship) issuing invoices on its own, it's entirely sufficient.

One important change: from 1 April 2026 the Trusted Profile operates within the so-called Węzeł krajowy (National Node, an SSO gateway), alongside the mObywatel app, the e-ID card (e-dowód), and bank login. This follows directly from the KSeF regulation (legal basis).

There's one limit that matters: a session opened with the Trusted Profile does not renew itself. Once it ends, you have to sign the XML again, so for steady, automatic operation a KSeF certificate is the better fit.

Method 2: Qualified electronic signature

This is the digital equivalent of a handwritten signature, valid across the EU under the eIDAS standard. You buy it from commercial providers (Certum, Sigillum, EuroCert) on an annual or multi-year subscription. It costs money.

For KSeF, it gives the same access as the Trusted Profile: manual login to the taxpayer app. It makes sense mainly if you already hold a signature for other purposes, such as court-register (e-KRS) filings, public procurement, or signing contracts. If you don't have one and don't need it elsewhere, the Trusted Profile is cheaper and just as effective.

A qualified signature is a permanent method. It doesn't expire with the transition period.

Method 3: Qualified electronic seal

This is the equivalent of a signature, but for non-natural persons (limited companies, joint-stock companies). The seal is tied to the company's NIP (tax identification number) rather than to an individual, so documents are signed on behalf of the organisation. It costs on the order of 1,500 PLN.

A real advantage: with a seal, a company can operate KSeF without filing the ZAW-FA form (the KSeF authorisation notice). For smaller entities a seal is usually unnecessary, but in a larger organisation it can be convenient.

Method 4: KSeF certificate (the target method)

This is a cryptographic tool issued free of charge by the Ministry of Finance Certification Centre. Unlike a token, a certificate is purely a means of authentication and carries no permissions of its own. It works much like a qualified signature, but purpose-built for KSeF (ksef.podatki.gov.pl).

A few concrete points worth knowing:

• Applications have been open since 1 November 2025, and authentication with a certificate has been possible since 1 February 2026.

• A certificate is valid for no more than 2 years.

• There are two types: Authentication (for login, including via API) and Offline (for the KOD II QR code on invoices issued in offline mode). One certificate cannot serve both roles.

• Limits: a natural person by PESEL or "certificate fingerprint" gets up to 6 active certificates, while an entity with a NIP (a company, or a sole trader with a NIP) can hold up to 100.

The certificate is the most sensible long-term choice, especially when integrating invoicing software with KSeF. The software does need to produce a XAdES-BES signature, so in practice your software handles that for you.

Method 5: KSeF token (and what may change)

A token is a 40-character string generated by KSeF after you log in. Unlike a certificate, a token carries the taxpayer's permissions inside it, which is what made it convenient for integrations: once generated, it lets software act on your behalf.

Pay attention here, because the legal position of tokens is unsettled. Under the current rules KSeF tokens expire on 31 December 2026. At consultations on 9 June 2026 the Ministry of Finance proposed keeping them, but no regulation has been adopted yet, so moving to a KSeF certificate is the safer choice (KSeF consultations, MoF).

The proposal would also change how tokens work: validity set anywhere from 1 to 365 days, plus automatic renewal with the owner's consent. It is only a proposal, so until rules are adopted it's worth following MoF communications, because details may still change.

The practical takeaway: until a rule extends tokens, it is safer to assume they stop working on 31 December 2026 and move to a certificate. Biurko does not support tokens as a connection method; it connects with Profil Zaufany or a KSeF certificate.

Which should you pick? A quick cheat sheet

Simple rule: the more invoices you handle and the more you want to automate, the further you move toward a certificate. Logging in manually for hundreds of invoices a month gets old fast.

Checklist before your first invoice

1. Decide whether you issue manually or through software. That settles the method.

2. For manual mode, check that you have an active Trusted Profile.

3. For software integration, apply for a KSeF certificate (Authentication type for login, Offline type for offline mode).

4. Confirm your software supports KSeF 2.0 and the FA(3) invoice schema.

5. Grant permissions to the people who will issue invoices.

6. Practise the full cycle in the Biurko demo (demo.biurko.io, 7-day access) or in the Ministry of Finance test environment before going live. An account on app.biurko.io sends invoices to production KSeF, so every invoice you send there is real.

Summary

Five methods sounds intimidating, but the choice usually comes down to one question: manual or through software. A solo sole trader is fine with a Trusted Profile. A business that wants to automate invoicing should head toward a KSeF certificate, and the token, under the current rules, expires on 31 December 2026; whether it stays depends on a decision by the Ministry of Finance.

Biurko connects to KSeF with a Trusted Profile (the default), your own KSeF certificate or a certificate ordered through Biurko; it does not support tokens. A session opened with a Trusted Profile does not renew itself, so for steady, automatic operation order a KSeF certificate in Biurko, after the first connection with a Trusted Profile, and use it to connect. Create an account at biurko.io and connect KSeF without fighting the login screen. To practise without legal effect, use the Biurko demo (demo.biurko.io, 7-day access, the KSeF demo environment). An account on app.biurko.io sends invoices to production KSeF, so every invoice you send there is real.

FAQ

What authentication methods are available in KSeF 2.0? Five: Profil Zaufany (from 1 April 2026 within the National Node), qualified electronic signature, qualified electronic seal, KSeF certificate, and token. The first four confirm identity; the token additionally carries permissions.

Will KSeF tokens disappear after 2026? Under the current rules KSeF tokens expire on 31 December 2026. At consultations on 9 June 2026 the Ministry of Finance proposed keeping them, but no regulation has been adopted yet, so moving to a KSeF certificate is the safer choice. Keep an eye on MoF communications.

How does a KSeF certificate differ from a token? A certificate is purely a means of authentication, carries no permissions, and is valid for up to 2 years. A token carries the taxpayer's permissions. You can use either to integrate software, but under the current rules the token expires on 31 December 2026, while the certificate is the target method.

Is Profil Zaufany enough for KSeF? For issuing a few invoices a month yourself in the browser, yes. For steady work of software via the API a certificate is better, though: a session opened with the Trusted Profile does not renew itself, and once it ends you must sign the XML again.

How much does KSeF authentication cost? The Trusted Profile, KSeF certificate, and token are free. The qualified electronic signature (annual subscription) and the qualified electronic seal (around 1,500 PLN, mainly for companies) are paid.