How to get a KSeF certificate

Invoicing software must have permission to act for your company before it sends invoices to KSeF for you. The current way to give this permission is a KSeF certificate. Generate the certificate yourself in the official KSeF application. Then upload it to your invoicing software.

This guide describes the steps at a high level. The official application changes from time to time. The screens, menu names and wording can be different from the text in this guide. Follow what the official app shows. If something looks different, see the help pages on ksef.podatki.gov.pl.

What you are making

A KSeF certificate is a small set of data. It proves that this software is allowed to act for this taxpayer. At the end of the procedure, you have these items:

a certificate (the public part);
a private key, usually in a file;
a password that protects the key.

The key file and the password together let a person send invoices as you. Protect them as you protect the keys to your bank account.

KSeF has more than one kind of certificate. You need the authentication certificate. With this certificate, software can log in to KSeF and send and receive invoices. Another kind of certificate is for offline situations. If you are not sure which is which, the official app shows a label on each.

Before you start

Prepare these items:

A way to log in to the official KSeF taxpayer application (Aplikacja Podatnika KSeF). See the next section.
Your NIP (Polish tax number).
A safe place to store files, such as a password manager that supports attachments or an encrypted drive.
About 15 to 30 minutes.

If you want to test first, use the KSeF test environment. It has its own application and its own certificates. Test and production are separate. A certificate from one does not work in the other.

Step 1: log in to the KSeF app

Open the official KSeF taxpayer application from the KSeF pages on the government site. Check that the address belongs to the government (the gov.pl domain) before you type anything. Phishing sites that copy government logins exist.

Choose how to authenticate. These are the common options:

Profil Zaufany (Trusted Profile), a free Polish government login. Check the government site to see who can get one and how the government confirms identity.
Bank login. Many Polish banks let you log in to government services with your online banking.
e-dowód, the Polish electronic identity card. Use it with a card reader or a phone app.
Qualified electronic signature, a paid signature from a certified provider. Some people already have one for business.

The correct method depends on your documents and your bank. If you do not have any of these, arrange one first. This can take some days. Your accountant can help you to choose.

Step 2: choose the company

The app can ask in which capacity or for which company you log in. If it does, select your own business. The NIP identifies it. The owner of a JDG usually logs in as the owner of their own company.

Step 3: find the certificates section

In the app, find the area for certificates or for access and authorisations. The wording can change, but the function stays the same. There is a place to create a new certificate for authentication.

If you do not see it, do these checks:

Make sure that you are logged in as the correct person for the correct company.
Make sure that you are in the correct environment (test or production).

Step 4: generate the authentication certificate

Start the process to create a new certificate. The app asks for a few details. It asks for a name for the certificate, so that you can recognise it later. It also asks for a password for the private key.

Follow these tips:

Give the certificate a name that includes the software and the date, for example “Fiskora 2026-11”.
Choose a long, unique password. A password manager can generate it.
Do not reuse a password from another service.

When the process ends, the app lets you download the result. Download it immediately and note where your device saves it. Depending on the app, you get the certificate and key as one file or as separate files. Keep all the files that the app gives you.

Step 5: store the file and password safely

This step is more important than any other step.

Keep a backup of the key file in an encrypted place.
Store the password separately from the file, preferably in a password manager.
Do not email the file to yourself or to other people. Do not leave it in a shared folder or in a chat history.
Delete the copies in your Downloads folder after you store and upload the file.
Find the expiry date of the certificate. Put a reminder in your calendar.

If you think that other people can see the file and password, revoke the certificate in the KSeF app. Then create a new certificate. The app can issue a new certificate at any time.

Step 6: upload it to your invoicing software

In Fiskora, open Settings, then KSeF. Add the certificate file and its password. Before you do this, Fiskora requires you to turn on two-factor authentication with an authenticator app. This prevents a person with only a stolen password from connecting or changing your KSeF access.

Fiskora stores the uploaded certificate in encrypted form. Fiskora uses it only to send and receive invoices for you. For the step-by-step procedure, see the help page on how to connect a KSeF certificate.

What if something goes wrong

Login fails. Make sure that you use the correct login method. Make sure that your Profil Zaufany or your bank works. Try a different method.
You cannot find the certificate section. The screen name can be different. Look for “certificates”, “access” or “authorisations”.
The software says the certificate is invalid. Make sure that you generated an authentication certificate. Make sure that the password is exact. Make sure that test and production match.
The certificate expired. Generate a new certificate and upload it again.

About tokens

In the past, KSeF access often used tokens. KSeF expects to remove tokens in the future. Fiskora does not use tokens for customers. Set up the certificate method.

Next steps

When the certificate is connected, send a test invoice from your own account. Then check that the UPO comes back. After that, give your accountant a read-only login.

If you are not sure what the official process requires for your situation, ask your accountant or the KSeF help desk.