Connecting KSeF to VAT4U: access options and invoice import
What is KSeF
KSeF (Krajowy System e-Faktur) is Poland's national e-invoicing platform, run by the Ministry of Finance. Since 2026, Polish VAT taxpayers issue structured invoices (XML, schema FA(3)) through KSeF, and every invoice gets a unique KSeF number. For buyers, KSeF is the official source of the invoices they received.
For VAT recovery this is good news: instead of collecting PDFs or paper, VAT4U can read your purchase invoices directly from KSeF, in their legally valid form.
Key dates of the KSeF 2.0 rollout (approximate, check the Ministry site for updates):
Date | What changed |
1 February 2026 | All taxpayers must receive invoices via KSeF; largest taxpayers (2024 sales above PLN 200m) must issue in KSeF |
1 April 2026 | Obligation to issue extended to all other taxpayers |
1 January 2027 | Smallest businesses join; penalties for non-compliance start |
KSeF runs three environments. Use Demo to rehearse the setup on real identity data with no legal effect, then repeat it in Production.
Environment | Taxpayer app | Purpose |
Test | Developer testing, fictitious data | |
Demo | Pre-production rehearsal, invoices have no legal effect | |
Production | Live, legally binding invoices |
Before you start: this guide applies to companies identified in KSeF by a Polish NIP. A foreign company without a Polish NIP has no KSeF account of its own to delegate from; ask your VAT4U contact about alternatives.
How you can authenticate to KSeF
VAT4U connects with a KSeF authentication certificate, because it lets software sign in on its own schedule without anyone approving each connection. The other methods matter too: you use one of them once, to obtain that certificate.
Method | What it is | Works unattended? | Role in the VAT4U setup |
Profil Zaufany / login.gov.pl | Polish national login for residents | No, interactive | One-time login to request the certificate |
Qualified electronic signature or seal | eIDAS qualified certificate, Polish or from another EU country | No, needs the holder each time | One-time login; also how a foreign person without NIP/PESEL is identified |
KSeF certificate (Authentication type) | X.509 certificate issued by KSeF, valid up to 2 years | Yes | What you deposit in VAT4U |
KSeF token | Secret string generated in the KSeF app, scoped to chosen rights | Yes | Alternative; not the standard VAT4U path |
Three principles apply to every method:
Identity and rights are separate. A certificate or token proves who is signing in. KSeF checks what that person may do in the chosen company (NIP) at every login, so you can change or withdraw rights without reissuing the certificate.
Read-only is a right, not a credential type. You get read-only access by granting only the invoice viewing right (przeglądanie faktur), described in the next section.
Pick the right certificate type. KSeF also issues Offline certificates, used to sign invoices issued in emergency mode. They cannot be used to sign in; only the Authentication type works for VAT4U.
Grant read-only access to a natural person
Your company grants one named person the invoice viewing right in KSeF; that person then obtains the certificate VAT4U uses. You choose who this person is:
Option | Who | How KSeF identifies them |
A. Your own employee | A person in your finance team with Profil Zaufany or a Polish qualified signature | NIP or PESEL |
B. A person nominated by VAT4U | A VAT4U team member, typically without Polish identifiers | Name, ID document and the fingerprint of their qualified certificate |
Sole traders (JDG) already hold owner rights on their own NIP and can skip this section if they obtain the certificate themselves.
Who can grant the right: the company's owner or representative, or a KSeF administrator with rights management. If nobody in your company can log in yet, a representative with a qualified seal or signature can do it, or you appoint a first administrator by filing the ZAW-FA notification with your tax office.
Steps in the KSeF taxpayer app
Log in to the taxpayer app (Demo or Production) in the context of your company's NIP.
In the left menu open Uprawnienia → Nadaj uprawnienie (Permissions → Grant permission).
Under Rodzaj uprawnienia, select Osobie fizycznej do pracy w KSeF (to a natural person, to work in KSeF).
Under Rodzaj podmiotu uprawnianego, pick the line matching your option:
Option A: Osoba fizyczna posługująca się Profilem Zaufanym lub certyfikatem zawierającym identyfikator NIP lub PESEL, then enter the person's NIP or PESEL.
Option B: Osoba fizyczna posługująca się certyfikatem niezawierającym identyfikatora NIP ani PESEL, set Identyfikator to Brak, then enter first name, surname, date of birth, ID document type, number and issuing country.
Option B only: paste the certificate fingerprint (Odcisk palca certyfikatu), 64 characters from 0–9 and a–f. VAT4U sends you this value together with the person's details.
Under Zakres uprawnień, tick only przeglądanie faktur (invoice viewing). Leave every other box empty.
Click Nadaj uprawnienia.
The right now appears under Uprawnienia → Zarządzaj uprawnieniami, where you can also withdraw it at any time. Withdrawing it stops VAT4U's access at the next login, even though the certificate itself stays valid.
Right in the form | English | Tick for VAT4U? |
wystawiania faktur | Issuing invoices | No |
przeglądania faktur | Viewing invoices | Yes |
przeglądania uprawnień | Viewing permissions | No |
przeglądania historii sesji (generowania UPO) | Session history and receipts (UPO) | No |
zarządzania jednostkami podrzędnymi | Managing subordinate units | No |
Generate the KSeF authentication certificate
The person who received the right logs in once and requests a certificate; this takes about five minutes. The portal creates the key pair on that person's computer, so the private key never passes through KSeF.
Log in to the taxpayer app in the same environment (Demo or Production) with Profil Zaufany or the qualified certificate registered in the previous step, in the context of your company's NIP.
Open Certyfikaty → Wnioskuj o certyfikat (Certificates → Request a certificate).
Enter a name that says what it is for, for example
VAT4U API – <company name>.Set a password for the private key: 15–32 characters, with upper and lower case letters, a digit and a special character. Write it down securely; it cannot be recovered.
Click Generuj to create the key pair.
Choose the certificate type Uwierzytelnianie w KSeF (Authentication). Do not choose Offline: an Offline certificate cannot sign in, and you would have to start again with a new key.
Set Certyfikat ważny od (valid from) to today. Validity can be up to 2 years.
Click Wyślij wniosek o wydanie certyfikatu (send the request).
When the status shows Zakończono pomyślnie (completed successfully), click Pobierz certyfikat (download).
You now hold three items, and all three are needed:
Item | Example name | Sensitivity |
Certificate |
| Public, safe to share |
Private key |
| Secret, never email it |
Key password | set in step 4 | Secret, never send with the key |
A certificate created in Demo works only against Demo. Repeat this section in Production when you go live.
Package the certificate and deposit it in VAT4U
VAT4U accepts the certificate as one PKCS#12 file (.pfx or .p12, the same format) plus its passphrase. You build this file from the .crt, the .key and the key password.
Build the .pfx file
With OpenSSL installed (built into macOS and Linux; on Windows use Git Bash or WSL), run in the folder holding both files:
openssl pkcs12 -export -out VAT4U-API.pfx -inkey VAT4U-API.key -in VAT4U-API.crt
OpenSSL first asks for the key password from the certificate request, then for a new export passphrase that protects the .pfx. The export passphrase can differ from the key password; this is the one you give VAT4U.
Check the result, which should list one certificate and one key:
openssl pkcs12 -info -in VAT4U-API.pfx -noout
If VAT4U reports that it cannot read the file, rebuild it with the -legacy flag added to the first command; some systems cannot open the newer encryption that OpenSSL 3 uses by default.
Deposit it in VAT4U
In VAT4U, open your company and go to the KSeF connector settings.
Companies -> Settings -> Connectors -> KSeF
Upload the
.pfx/.p12file.Enter the export passphrase in the passphrase field. Never send it by email or in the same message as the file.
Confirm the company NIP that VAT4U should read invoices for, and the environment (Demo or Production).
Save. VAT4U runs a test sign-in and shows whether the connection works.
How VAT4U retrieves your invoices and imports them
VAT4U signs in to KSeF with your certificate, reads only the invoices where your company is the buyer, and turns each one into an expense. It never issues, changes or deletes anything in KSeF; the invoice viewing right would not allow it.
Each synchronisation runs these steps:
Sign in. VAT4U requests a one-time challenge from KSeF, signs it with your certificate (XAdES signature) in the context of your company NIP, and receives a short-lived access token. KSeF checks the invoice viewing right at this moment.
Find new invoices. VAT4U queries KSeF for purchase invoices received since the last synchronisation.
Download. Each new invoice is downloaded as its original KSeF XML, identified by its KSeF number.
Skip duplicates. An invoice whose KSeF number is already in VAT4U is not imported twice.
Create the expense. The XML becomes an expense in your company: supplier name and NIP, invoice number and date, currency, and net, VAT and gross amounts per VAT rate. The original XML is kept as the expense document.
Standard processing. Imported expenses go through the usual VAT4U checks (category, deductibility, compliance) and appear in your expense list, filterable by import, ready to be added to a claim.
Because KSeF invoices are structured data, no OCR is needed and amounts arrive exactly as issued.
Suggestion: establish a scheduled extraction with auto-import option to always have your expenses automatically pulled and imported.
Stopping or pausing the connection
Pause in VAT4U: remove or disable the certificate in the KSeF connection settings.
Stop at the source: withdraw the invoice viewing right in KSeF (Uprawnienia → Zarządzaj uprawnieniami). This takes effect at VAT4U's next sign-in.
Revoke the certificate: in KSeF under Certyfikaty, if you suspect the key or passphrase leaked.
Security, renewal and troubleshooting
Can VAT4U issue invoices or change anything in KSeF? No. With only the invoice viewing right, KSeF refuses any other action, whatever the certificate.
What happens when the certificate expires? Sign-in fails and imports stop. Request a new certificate (section above) at least two weeks before the end date, rebuild the .pfx and replace it in VAT4U. The granted right does not need to be granted again.
The person who holds the right leaves the company. Withdraw their right in KSeF, revoke their certificate, then grant the right to a new person and repeat the certificate steps.
Do we need one setup per company? Yes, rights are granted per NIP. One person may hold rights in several companies, but VAT4U signs in to one NIP context at a time, so confirm with your VAT4U contact how to register each company.
Symptom | Likely cause | Fix |
VAT4U cannot open the file | Wrong passphrase, or OpenSSL 3 encryption not supported | Re-enter the export passphrase; rebuild the |
Sign-in refused | Offline certificate instead of Authentication | Request a new certificate of type Uwierzytelnianie w KSeF |
Sign-in refused | Demo certificate used against Production, or the reverse | Generate the certificate in the matching environment |
Sign-in works, no access to the company | Invoice viewing right missing or withdrawn, or wrong NIP entered in VAT4U | Check Uprawnienia → Zarządzaj uprawnieniami; check the NIP in VAT4U |
Option B grant rejected | Fingerprint mistyped or taken from the wrong certificate | Ask VAT4U to resend the 64-character SHA-256 fingerprint |
No invoices imported | Suppliers issued no KSeF invoices in the period, or invoices predate the sync start | Check the invoice list in the KSeF app for the same dates |
Sources
VAT4U internal test of the delegated-access setup in KSeF Demo (screenshots above, personal data removed)