What is the difference between 21116, 21302, and 21303?

21116 = token unrecognized (wrong value, wrong environment, wrong context). 21302 = token exists but is inactive (not yet activated or explicitly deactivated). 21303 = token was revoked. All three block InitToken; the fix path differs.

Can a KSeF token authenticate against both test and production?

No. Tokens are environment-scoped. Any token generated on ksef-test.mf.gov.pl will return 21116 when used against ksef.mf.gov.pl and vice versa.

How long do KSeF tokens live?

Tokens do not have a fixed expiry — they remain valid until revoked. However, best practice is to rotate quarterly and to have at least two active tokens per NIP context so rotation can happen without downtime.

Can Invoice Navigator manage KSeF tokens for me?

Yes — Invoice Navigator handles token generation, rotation, environment isolation, and revocation monitoring per NIP context. Your ERP integrates with one Invoice Navigator API key that never rotates.

Why did my token work five minutes ago and stop working now?

Either the token was revoked (check /online/Credentials/List — you will see it in state Revoked or missing entirely), or you are inadvertently pointing at a different environment. Log the request host and Authorization header (redacted) on any 21116 to catch environment drift.

Error codes · ksef · Poland

KSEF-21116Partly

KSeF authentication token is invalid

This is the rejection, word for word: „[KSEF-21116] KSeF error 21116 ("Nieprawidłowy token") is returned when the AuthorisationToken supplied to /online/Session/InitToken does not match a valid, active token issued for the target NIP context. Unlike 21170 (session expired) or 21302 (token inactive), 21116 means KSeF cannot recognise the token at all — wrong value, wrong environment, or wrong context.“

KSeF supports two authentication paths: signed challenge (qualified electronic signature or personal seal) and token-based (a token issued via /online/Credentials/GenerateToken). Tokens are context-bound: a token generated for NIP A cannot authenticate for NIP B, and a token generated in the test environment cannot authenticate against production. The AuthorisationToken is included in the signed InitToken payload as base64-encoded plaintext.

What to have readyThe correct figures from your bookkeeping; we show you which field is affected.

What we doVerify the token value character-for-character, confirm you are calling the correct environment (test vs production), and confirm the token was generated for the exact NIP context you are authenticating against.

Choose the rejected invoiceor drop it here

XRechnung XML or ZUGFeRD PDF. Checking is free · corrected file €1.90 · the first every 30 days is free · no sign-up.

What the finding looks likeExample

FindingNeeds your check · KSEF-21116

From youThe correct figures

ThenChecked again

ProofSHA-256 and /verify link after the check

Often appears together with

KSEF-21121KSeF rate limit reached for this endpoint KSEF-21170KSeF interactive session has expired KSEF-21301Missing authorization for this KSeF operation