Skip to main content
KSeF 2.0

KSeF 2.0: token, KSeF certificate or Trusted Profile? How to choose

To log in to KSeF yourself you can use the Trusted Profile, a qualified electronic signature or, since 1 April 2026, the national node login.gov.pl. For Odoo to send invoices with its native module, the company needs a KSeF certificate. And to request that certificate, you first have to authenticate with one of the first methods. This guide helps you put the decision in order.

FlexigoTech · Editor in charge: Víctor Gómez · Updated 3 November 2026

Key facts

Module
KSeF 2.0
Versions
Odoo 17, 18, 19 and 20
Checked
in the module's source code, version 20.0 · against the sources linked at the end
Reading time
3 min

The methods KSeF 2.0 accepts

According to the Ministry of Finance manual, in KSeF 2.0 you can authenticate with:

  • Trusted Profile (Podpis Zaufany).
  • Qualified electronic signature.
  • KSeF token.
  • KSeF certificate.
  • Since 1 April 2026, the national node login.gov.pl, with Podpis Zaufany, the mObywatel app, online banking or e-Dowód.

The questions that decide

QuestionIf the answer is yes
Will you log in to the KSeF application yourself to check or issue by hand?Trusted Profile, qualified signature or national node.
Do you want Odoo to send invoices with l10n_pl_edi?A KSeF certificate stored on the Odoo company.
Do you not have a KSeF certificate yet?Request it after authenticating, for example with Podpis Zaufany or a qualified signature.
Do you use tokens in other programs?You can keep going: the Ministry keeps them with no end date.
Are you on Odoo 17?l10n_pl_edi does not exist in 17: sending happens outside Odoo.
KSeF legal policy configured in the Odoo module
The module's legal policy: dates are data you configure, not fixed text. Odoo screenshot with demo data.

How Odoo uses it

In Odoo 19, l10n_pl_edi stores a "KSeF Certificate" on the company and authenticates with it. A scheduled action renews the access tokens of every company that has a certificate, so nobody has to copy tokens by hand.

The FlexigoTech module does not connect to KSeF: it validates FA(3) and watches your credentials. Under Configuration › Credentials you store certificates and tokens with their expiry, and under Authorizations the authorisations you have granted. Every day it warns about what is about to expire, with a traffic light: OK, expiring, blocked or expired, and the countdown of 30, 14, 7 and 1 days.

FA(3) schema fields validated by the KSeF module in Odoo
Besides credentials, the module validates each invoice against the FA(3) fields. Odoo screenshot with demo data.

What to store and where

In the module, every credential has its state and expiry date, and every authorisation its own: active, expiring, revoked or expired. Legal dates, such as when the obligation starts for each type of company, are configured under Configuration › Legal Policy instead of being written into the code. And every change is kept in Configuration › Audit Log, so you know who touched a credential and when.

Planning mistakes we see

Thinking the Trusted Profile disappears in April 2026. It does not: on 1 April 2026 one more channel opens, the national node, and the Trusted Profile stays within it.

Counting on tokens expiring at the end of 2026. That was the initial idea; the Ministry decided to keep them with no end date.

Configuring Odoo before having the certificate. Without a certificate, native sending cannot authenticate. Request it first.

An order that works

First, log in to KSeF yourself with the method you already have, be it the Trusted Profile or a qualified signature. Second, request the company's KSeF certificate. Third, store it in Odoo 18, 19 or 20 for native sending and register it in the module to watch its expiry. That way nobody depends on a token pasted into an email.

Authorisations also expire or get revoked. The module's daily warning includes them so nobody finds out on the day an invoice does not go out.

Keep reading

KSeF 2.0: the 2026 and 2027 timeline, and what to prepare in Odoo for each dateOfficial KSeF 2.0 dates in Poland (February and April 2026, January 2027), the postponed penalties and what to have ready in Odoo for each one.KSeF in Odoo 17, 18, 19 and 20: what changes with your versionKSeF differences between Odoo 17 and Odoo 18, 19 and 20: native sending with l10n_pl_edi, where the validated FA(3) comes from and what the module does in each version.
Checked in the module's source code (version 20.0) and the linked sources

Sources