Skip to main content
KSeF 2.0 · authentication

Signing in to KSeF with a certificate: code 460 and XAdES signature errors

Odoo 18, 19 and 20 connect to KSeF only with a KSeF certificate: they sign a challenge with an XAdES signature and send it to POST /auth/xades-signature. If something is wrong with the certificate or the signature, KSeF answers with one of the eleven codes on this page, but Odoo usually shows little of it.

FlexigoTech · Editor in charge: Víctor Gómez · Updated 5 November 2026

Key facts

Module
KSeF 2.0
Versions
Odoo 17, 18, 19 and 20
Checked
in the module's source code, version 20.0 · against the sources linked at the end
Reading time
3 min

When Odoo signs in

Odoo authenticates at two moments: when you save the KSeF certificate with its private key in the settings, and in the scheduled action “Refresh KSeF tokens”, which repeats the full sign-in every 6 days. The context is the company's NIP, so the company VAT number has to start with PL. The KSeF challenge is valid for 10 minutes.

KSeF code 460 card with the XAdES signature exceptions
Code 460 and the ten exceptions returned by POST /auth/xades-signature.

The codes and their texts

CodeKSeF text
9101“Nieprawidłowy dokument.” (invalid document)
9102“Brak podpisu.” (no signature)
9103“Przekroczona liczba dozwolonych podpisów.” (too many signatures)
9105“Nieprawidłowy podpis.” (invalid signature)
21111“Nieprawidłowe wyzwanie autoryzacyjne.” (invalid authorisation challenge)
21115“Nieprawidłowy certyfikat.” (invalid certificate)
21117“Nieprawidłowy identyfikator podmiotu dla wskazanego typu kontekstu.” (invalid subject identifier for the context type)
21217“Nieprawidłowe kodowanie znaków.” (invalid character encoding)
21401“Dokument nie jest zgodny ze schemą (xsd).” This is the sign-in XML, not the invoice.
21406“Konflikt podpisu i typu uwierzytelnienia.” (signature and authentication type conflict)
460“Uwierzytelnianie zakończone niepowodzeniem z powodu błędu certyfikatu”, with details: “Nieważny certyfikat”, “Błąd weryfikacji łańcucha certyfikatów”, “Niezaufany łańcuch certyfikatów”, “Certyfikat odwołany”, “Certyfikat zawieszony” or “Niepoprawny certyfikat” (expired, chain error, untrusted chain, revoked, suspended, incorrect).

The first ten arrive at once, as an HTTP 400 answer to the signature. Status 460 comes later, when the sign-in status is checked. A word of caution about the specification itself: the examples for that request show code 400 with the description “Uwierzytelnianie zakończone niepowodzeniem” for the same reasons, while the status table gives 460. The details text matters more than the number.

What Odoo will not show

When the signature fails, Odoo writes “Failed to authenticate with XAdES:” followed by the exception text from the requests library, along the lines of “400 Client Error: Bad Request for url: …/auth/xades-signature”. The code from the table never reaches the screen: Odoo only takes the response body when the response object is “truthy”, and in requests a response with a code from 400 to 599 is falsy. The same happens when fetching the challenge, checking the status and redeeming the tokens.

For status 460 Odoo writes “KSeF Authentication failed with status 460: …” with the description and without the details.

When the renewal every 6 days fails, it only leaves a trace in the server log. The KSeF refresh token lasts up to 7 days; after that, sending ends with “Failed to refresh KSeF access token. You may need to re-authenticate manually.”.

The credentials list in our module

KSeF credentials list in the module, with two rows in orange
Screenshot with demo data: two entries are orange because they expire in less than 30 days.

Poland KSeF 2.0 Validator has a list under KSeF › Configuration › Credentials with KSeF certificates, tokens, seals and qualified signatures and the days left before each expires: orange with 30 days or fewer, red once expired. Whoever adds an entry types its expiry date. The module does not read the certificate in Odoo's settings or its state in KSeF, so it will not flag a revoked or suspended certificate.

What to do

  1. Check in the settings that the selected record is a KSeF certificate with its private key.
  2. Check the validity dates and whether the certificate was revoked or suspended in KSeF.
  3. Check that the company VAT number starts with PL and is the NIP the certificate was issued for.
  4. Save the certificate in the settings again. If the error comes back and Odoo only shows “400 Client Error”, ask for the KSeF response with its code to be read.

Keep reading

KSeF authentication statuses: 415, 425, 450, 470 and 480KSeF 2.0 sign-in statuses besides certificates: no permissions, revoked, bad token, blocked. Codes 21301 and 21304 and how they look in Odoo 18-20.KSeF codes 410 and 415: seller permissions and attachmentsKSeF 410 “Nieprawidłowy zakres uprawnień” and 415 for invoices with attachments: what triggers them in the Ministry's tests and what to check in Odoo 18-20.KSeF HTTP 429, 403 and 401: request limits and access deniedKSeF 2.0 answers 429 Too Many Requests over the limit, 403 with a reasonCode when access is missing and 401 on an expired token. Limits and what Odoo does.
Checked in the module's source code (version 20.0) and the linked sources

Sources