Does 21301 mean my token is invalid?

No — an invalid token returns 21116 or 21302. 21301 means the token authenticated successfully but has no permission for the operation. Fix the grant, not the token.

How long does a KSeF grant take to become effective?

The Ministry of Finance documents propagation as up to 15 minutes — in practice most grants are active within 2-3 minutes. If a grant is over an hour old and still failing, verify the grant was issued to the correct identifier (NIP vs PESEL) and role.

Can Invoice Navigator issue KSeF grants for me?

No — grants must be issued by an authorized signatory on the grantor's KSeF account, either through the Taxpayer Application portal or a signed /online/Credentials/Generate request. Invoice Navigator surfaces which grant is missing so you can request it from the correct counterparty.

Why did self-billing work in June but fail after the KSeF 2.0 cutover?

KSeF 2.0 requires an explicit samofakturowanie credential registered in KSeF. Pre-2.0 arrangements based on paper agreements are not auto-migrated. Both parties must re-establish the grant in KSeF before self-bills will be accepted.

Which roles does the invoice_write grant cover?

invoice_write authorizes submitting invoices where the granting NIP is the SELLER. It does not authorize self-billing (samofakturowanie) or credentials management. If you need to submit as buyer on the seller's behalf, you need samofakturowanie, not invoice_write.

Error codes · ksef · Poland

KSEF-21301Partly

Missing authorization for this KSeF operation

This is the rejection, word for word: „[KSEF-21301] KSeF error 21301 ("Brak autoryzacji") is returned when the authenticated token has no permission to perform the requested action in the current NIP context. The most common trigger is attempting to issue a self-billing invoice (samofakturowanie) without an active samofakturowanie authorization on the seller's NIP, but any missing permission — invoice-write, credentials-manage, tax-representative — surfaces the same code.“

KSeF enforces a role-based permission model per NIP context. Each authorization is a signed grant recorded in KSeF that maps (grantor NIP → grantee identifier → role → validity window). Roles include invoice_read, invoice_write, credentials_read, credentials_manage, subunit_manage, and role-specific ones like samofakturowanie (self-billing) and tax_representative. 21301 fires when the caller's session has no matching active grant for the operation.

What to have readyThe correct figures from your bookkeeping; we show you which field is affected.

What we doVerify that the required KSeF authorization (invoice_write, samofakturowanie, or the specific role the endpoint requires) has been granted on the target NIP context and that the grant is still within its validity window. Grants take up to 15 minutes to propagate after issuance.

Choose the rejected invoiceor drop it here

XRechnung XML or ZUGFeRD PDF. Checking is free · corrected file €1.90 · the first every 30 days is free · no sign-up.

What the finding looks likeExample

FindingNeeds your check · KSEF-21301

From youThe correct figures

ThenChecked again

ProofSHA-256 and /verify link after the check

Often appears together with

KSEF-21116KSeF authentication token is invalid KSEF-21121KSeF rate limit reached for this endpoint