KSeF connection setup

What it does

In Invoice Manager → Configuration, a venue in Poland chooses which KSeF environment its invoices go to and saves how POSolid logs in to KSeF on its behalf — with the venue's KSeF certificate. A checklist at the top shows what is still missing for the current environment.

Getting started

KSeF environment. It starts on Test, where invoices have no legal effect — use it to try things out. Demo uses your venue's real NIP and a real certificate, but the invoice data is fictitious. Production is for legally binding invoices; switching to it asks you to confirm.
Number series for this environment — see Invoicing setup.
KSeF login. In KSeF connection, save how POSolid logs in to KSeF for this environment:
- Certificate (recommended) — upload the certificate (.crt) and its private key (.key), or a single .pfx file, with its password. The password is used once to open the file and is never stored. Request the certificate in the KSeF Taxpayer Application for your NIP.
- Quick setup for Test — on Test, Create a test certificate makes one for your NIP in a click.
- KSeF token — still accepted until 31 December 2026. Generate it in the KSeF application with the right to issue invoices for your NIP.
Tap Test connection. "KSeF accepted the login" means you're ready.
When you're ready for real invoices, switch to Production, set up its number series and save a production certificate.

Key things to know

Each environment is set up separately — its own number series and its own KSeF login.
The login is write-only. A saved certificate or token is stored encrypted and never shown again — the screen shows only its last characters, the certificate's owner and its expiry date.
Expiry reminders. 30, 14, 7, 3 and 1 day before the KSeF login in use stops working (a certificate's own expiry, or a token at the end of 2026), the people with Manage invoices get a notification. It goes away when a new login is saved.
Nothing is lost while the login is missing. Invoices wait in the queue and are sent automatically as soon as a working certificate or token is saved.
Removing the login stops sending for that environment; invoices wait until a new one is saved.
Only people with the Manage invoices permission can change the environment or the login.

FAQ

Q: Which login should I use, a token or a certificate?
A: A certificate. Tokens stop working on 31 December 2026; from 1 January 2027 KSeF accepts only certificates.

Q: Test connection fails. What should I check?
A: That the certificate or token was issued for the same NIP as in your organization settings, that it has the right to issue invoices, and that you saved it for the environment you are testing.

Q: Can I use the test certificate in Production?
A: No. Demo and Production accept only a real certificate issued for your NIP.