How long does a KSeF interactive session last?

The Ministry of Finance documents a 2-hour absolute lifetime for interactive sessions with an activity-based refresh window. In practice, plan for a hard 2-hour ceiling and re-authenticate proactively at ~90 minutes.

Can I extend a session before it expires?

No — there is no session-extend endpoint. Once you have a session token, its expiry is fixed. The only way to extend is to run AuthorisationChallenge again and start a new session.

Does 21170 mean my token is compromised?

No — 21170 is a normal lifecycle event, not a security event. Discard the token and re-authenticate. Compromised tokens surface as 21302 (Token nieaktywny) or 21303 (Token unieważniony).

Should I re-authenticate before every request to avoid 21170?

No — AuthorisationChallenge is rate-limited (see KSEF-21121) and re-authenticating per request will hit that quota fast. Use one session per worker and refresh at 90 minutes.

Can Invoice Navigator hide session management from my ERP?

Yes — Invoice Navigator exposes long-lived API keys to your ERP and manages KSeF session lifecycle internally, including 21170 recovery, proactive refresh, and per-context session pooling.

Error codes · ksef · Poland

KSEF-21170Partly

KSeF interactive session has expired

This is the rejection, word for word: „[KSEF-21170] KSeF error 21170 ("Sesja interaktywna wygasła") is returned when the caller uses a session token whose validity window has elapsed. Interactive sessions have a bounded lifetime set by the Ministry of Finance (currently 2 hours from InitSession, refreshed by activity), and once expired the session cannot be resumed — a fresh authentication challenge is required.“

KSeF sessions come in two shapes: interactive (/online/Session/InitSigned or InitToken) and batch (/batch/Session/*). Interactive sessions carry a session token in the SessionToken header and are subject to both an absolute lifetime and an idle timeout. When either boundary is crossed, subsequent calls with that token return HTTP 401 and exceptionCode 21170. The session cannot be extended after expiry — the client must run AuthorisationChallenge → InitSigned/InitToken again.

What to have readyThe correct figures from your bookkeeping; we show you which field is affected.

What we doDetect 21170, discard the expired session token, run a fresh authentication challenge, and replay the failed request under the new session. Add proactive session refresh before the documented lifetime elapses.

Choose the rejected invoiceor drop it here

XRechnung XML or ZUGFeRD PDF. Checking is free · corrected file €1.90 · the first every 30 days is free · no sign-up.

What the finding looks likeExample

FindingNeeds your check · KSEF-21170

From youThe correct figures

ThenChecked again

ProofSHA-256 and /verify link after the check

Often appears together with

KSEF-21116KSeF authentication token is invalid KSEF-21121KSeF rate limit reached for this endpoint KSEF-21301Missing authorization for this KSeF operation