KSeF access governance is not only an IT configuration task. It is a finance control environment covering who can issue, receive, view, authorise and technically transmit invoices. API tokens should have a named owner, limited scope, rotation rules and an audit trail.
Four access layers that must be separated
| Layer | Purpose | Risk |
|---|---|---|
| Employee permissions | Named user access for invoice work | Former employees or excessive rights |
| API token | Technical system access | Uncontrolled invoice transmission |
| ERP integration | Automated data exchange | Incorrect mapping or missing validation |
| Governance | Review, approval and monitoring | No ownership of exceptions |
Who should own the API token?
The token should have a business owner in finance and a technical custodian in IT. Finance decides the process risk, approval logic and exception handling. IT protects the secret, manages integration security and logs technical events.
Segregation of duties
No single role should be able to create suppliers, change bank accounts, issue invoices, approve exceptions and manage the integration token without review. KSeF does not remove segregation of duties. It makes weak segregation more visible.
Emergency access
Emergency access should be temporary, approved, logged and reviewed after use. The review should identify which invoices were affected, whether manual intervention was necessary and whether the same access remains open.
Audit trail and monitoring
A useful audit trail shows who granted access, when it was used, which invoices were processed, which errors occurred and who closed the exception. This supports internal control, statutory audit and tax-risk management.
Frequently asked questions
Is your KSeF token controlled?
JMFC can review KSeF access matrices, token ownership and invoice authorisation controls from a finance-governance perspective.