KSeF Tokens: How Long Are They Valid, and What the MF Proposal Changes

KSeF token validity: the short answer

The formal position today: the ability to generate and use tokens expires at the end of 2026. This follows from the KSeF 2.0 Handbook (Part I) and the Ministry of Finance regulation on the use of KSeF. That deadline is still formally in force.

The proposal today: at the 9 June 2026 consultations MF proposed that the token remain a permanent login method beyond 31 December 2026. That proposal has not yet been turned into a legal provision. Until an amendment passes, the letter of the existing schedule applies, not a proposal from a consultation.

The token itself has no "expiry date" in the classic sense. KSeF does not define how long a token stays active. It remains valid until the user revokes it. So "how long" is a question about the whole mechanism, not about a single token.

What MF actually proposed in June 2026

At the first consultations after the partial rollout of KSeF on 9 June 2026, the ministry proposed that tokens remain available after 31 December 2026. The proposal also floated a token validity window of 1 to 365 days with a renewal mechanism, plus new token-linked permissions.

A plausible motive: many taxpayers still log in with a token, and forcing everyone to migrate within a few weeks would create risk.

Three things to keep in mind:

1. This is a consultation proposal, not a finished implementation instruction.

2. As of 8 October 2026, no provision introducing these measures has been adopted.

3. Until the act and the regulation are amended, the legal state has not changed.

In short, the direction is clear, but the dates in the proposal (the 1 to 365 days) are not yet law. In client-facing content and in system configuration, "MF has proposed" is safer than "from 2027 a token is valid for X days."

KSeF token vs certificate: the real difference

Even if the token stays, it is not the same tool as a certificate. The difference is practical, not cosmetic.

Certificates come in two types. The Authentication type is for login (interactive and batch sessions). The Offline type is for the second QR code (KOD II) on invoices in the offline modes: offline24, system unavailability, and emergency mode. A token cannot do this.

What a token cannot do

This is the heart of the matter for companies that issue invoices at volume.

A token works online only. If the KSeF API stops responding, you cannot add the second QR code (KOD II) to an offline invoice with a token. An Offline-type certificate can.

After every change to the permission scope, a token has to be regenerated and re-entered into the software. With a certificate, changing permissions in the system does not mean replacing the certificate itself.

Logging in with a token does not let you request a KSeF certificate. If a company built its integration purely on tokens, moving "toward a certificate" requires first authenticating by another method (signature, seal, or Profil Zaufany, Poland's Trusted Profile).

A real-world accounting-office example

An office serves 40 clients. Some of them handed the office a token for sending invoices. On a Friday afternoon KSeF has an outage. Clients call, because they need invoices dated today.

On tokens the office cannot add the second QR code (KOD II): a token works online only. With Offline-type certificates the invoices can be issued in offline24 mode with both codes and submitted once the system returns, keeping the original date. That is not a theoretical gap. It is the difference between "sorry, we'll call you back" and "already done."

What to do now: a decision independent of the token's fate

Even if the token stays, it is worth holding certificates. The reason is simple: the full marking of an offline invoice, with the second QR code (KOD II), needs an Offline-type certificate. A company without one has only the first QR code on the day KSeF goes down.

Under the current rules tokens expire on 31 December 2026, so do not wait for an MF decision: issue certificates at your own pace, before the December rush of applications.

Checklist: KSeF tokens in your company

1. Identify which integrations (software, accounting office, ERP) log into KSeF with a token.

2. Record who generated each token, its permission scope, and when it was created.

3. Track MF communications, since they will settle the token validity mechanics.

4. Issue a KSeF certificate, Authentication type (login) and Offline type (offline/emergency), even if you stay on a token.

5. Do not build a multi-year procedure around tokens alone; keep the token for convenience and the certificate as the foundation.

6. Limit token permissions to the minimum needed (for example, issuing and accessing invoices), not "everything."

Summary

The answer to "how long are KSeF tokens valid" has two layers today. Under current rules: end of 2026. MF's proposal: keep tokens, but that is not yet a rule. The safe approach is to rely on the deadline in force and to hold certificates regardless of the decision.

Biurko is built around KSeF certificates from day one (it does not support tokens), so the Offline-type certificate with the second QR code is there immediately, not bolted on later. Start on the FREE plan at biurko.io, or ask for the demo (demo.biurko.io, 7-day access) to see the certificate setup without legal effect. An account on app.biurko.io sends invoices to production KSeF, so every invoice you send there is real.

FAQ

How long are KSeF tokens valid? Under the current rules KSeF tokens expire on 31 December 2026. At consultations on 9 June 2026 the Ministry of Finance proposed keeping them, but no regulation has been adopted yet, so moving to a KSeF certificate is the safer choice.

Does a KSeF token have an expiry date? The token itself has no predefined lifetime. KSeF does not set how long a token is valid; it stays active until the user revokes it. MF's June proposal floated a 1 to 365 day validity window, but that is only a proposal for now.

Do I have to switch from a token to a certificate? If MF's proposal becomes law, you will not have to drop the token. A certificate is still worth having, because only an Offline-type certificate gives the second QR code (KOD II) in offline modes, which a token cannot do. Until rules are adopted, moving to a certificate is the safer choice.

What is the difference between a token and a KSeF certificate? A token carries baked-in permissions and handles automatic app login. A certificate proves identity, lasts up to two years, in the Offline type supports the second QR code in offline modes, and does not need regenerating when permissions change.

Does a KSeF 1.0 token work in KSeF 2.0? No. Tokens generated in KSeF 1.0 are not valid in KSeF 2.0 and must be generated again.

This article is informational and is not tax or legal advice. Confirm deadlines and the scope of changes against current MF communications at ksef.podatki.gov.pl.