KSeF tokens: permission changes, company context and invalidation
Why granting another permission does not update a KSeF token, how the NIP context works and why removing access is not invalidation.
Your software has a KSeF token but still cannot retrieve invoices after permissions change? Check the token’s scope, company context and its holder’s current permissions separately. These are three different parts of access.
A new permission is not added to the token
The scope is selected when generating the token, from permissions held at that time. An existing token cannot be updated to add another permission. If it previously allowed only issuing invoices, subsequently granting the holder invoice access does not expand that token. Prepare a suitable token for the new scope and check the software configuration.
Check the NIP context
A token generated in your sole trader’s context cannot authenticate in a client’s or another company’s context. Someone authorised for several businesses still needs the token matching the specific context. Record the integration name, context and required actions; do not put the token value in an ordinary note.
Removing a permission is not invalidating the token
Removing a holder’s permission also removes its effect in the linked token. It does not automatically invalidate the token itself. If that permission is granted again, it can work through the token again. When permanently ending its use, therefore check removal of unnecessary permissions and invalidation of the unwanted token separately.
FAQ
Can I add invoice reading to an existing token?
Not by updating its scope. A new holder permission and the generated token’s scope are separate matters.
Does an accountant’s token cover every client?
No. It is bound to the context in which it was generated. Permissions for several businesses do not remove that boundary.
Does removing every permission destroy the token?
No. Without permissions authentication becomes unavailable, but the system does not invalidate the token for that reason.
Source
Ministry of Finance: KSeF 2.0 handbook.
Next step
Describe your issue in the Oxyok form. Do not send passwords or access keys..