KSeF certificates type1 and type2: software access and offline use
Separate KSeF certificate types, their purposes and the validity and permissions to check before configuring software.
One KSeF certificate cannot serve both purposes. Before configuring software, decide whether you need authentication, identification of an offline invoice’s issuer, or both.
Type1 for authentication
Type1 authenticates in KSeF. It does not independently grant permission to issue or retrieve invoices: after login, the system applies assigned permissions. Check a working certificate and appropriate company access separately.
Type2 for identifying an offline issuer
Type2 supports the code verifying the invoice issuer in offline24, KSeF unavailability and outage modes. This differs from type1 authentication. The certificates are generated separately; one cannot cover both uses. Document delivery and the number of QR codes depend on the mode and buyer.
Check expiry and prepare continuity
Validity is no longer than two years from the specified start date, or issue date if none was specified. Check the actual expiry, holder and type of the particular certificate. Arrange a successor before expiry; do not prepare offline capability only after losing internet access.
FAQ
Does type1 replace type2?
No. Authentication and identification of the offline issuer use two distinct types.
Does every certificate last exactly two years?
No. Two years is the maximum. Check the actual dates of your certificate.
Does holding a certificate grant client access?
Not by itself. A certificate establishes identity; actions require the appropriate KSeF permissions.
Source
Ministry of Finance: KSeF 2.0 handbook.
Next step
Describe your issue in the Oxyok form. Do not send passwords or access keys..