Configure certificates in Sovos
Use the configuration API to configure your certificates in Sovos.
-
Outbound configuration: Invoice submission (
pl_Faktura__2.0) -
Inbound configuration: Invoice polling (
pl_Faktura_Polling_2.0)
Use the same Type 1 certificate for both directions; only the productId differs.
Certificates reference
- Certificate property reference
-
When you configure your certificates in Sovos, use the appropriate properties for your certificate format:
Certificate type Format Required properties Type 1 (Authentication) PEM CertificateCrtBase64
CertificateCrtKeyBase64
CertificateCrtPassword
Type 2 (Offline) PEM CertificateOfflineBase64
CertificateOfflineKeyBase64
CertificateOfflinePassword
- Certificate expiration
-
Monitor certificate expiration dates and renew at least 30 days before expiration. Request new certificates through the KSeF portal before your current certificates expire.
API endpoint
POST https://api-test.sovos.com/v2/configurations/organizations/{orgId}/settings
Authorization: Bearer {accessToken}
Content-Type: application/json
Environment URLs
-
Production: https://api.sovos.com
Key parameters
-
category: AlwaysPL_INVfor Poland -
productId:pl_Faktura__2.0(submission) orpl_Faktura_Polling_2.0(polling) -
workspaceId: Your Sovos workspace identifier -
orgId: Your Sovos organization identifier -
taxId: Your 10-digit NIP (optional but recommended)
Do not include operation parameter in certificate configurations. Operation is only used for token-based authentication.
Outbound configuration
Learn how to configure outbound settings for invoice submission using Sovos.
After completing these steps, you have the credentials needed to submit invoices to KSeF through Sovos.
Inbound configuration
Learn how to configure outbound settings for invoice polling using Sovos.
-
productId: Changes topl_Faktura_Polling_2.0 -
Certificate: Use same Type 1 certificate files -
Configuration: Create separate configuration (different API call)
Inbound polling does not need Type 2 offline certificate. Type 2 is only used during outbound submission for offline mode QR code generation.
After completing these steps, you have the credentials needed to get invoices through Sovos.
Troubleshooting
This section presents solutions to common problems encountered during certificates configuration.
Missing or overwriting Type 1 when configuring offline
- Symptom
- All transmissions fail after adding Type 2.
This might occurs when you send a configuration API call with matching scope parameters (category, productId, workspaceId, orgId, taxId), the API completely replaces the existing configuration. If you only include Type 2 properties, you overwrite and remove your previously configured Type 1 certificate.
- Solution
- Configure Type 1 (authentication) and Type 2 (offline) in the same API call. Sending only Type 2 properties overwrites and removes Type 1.Note:
Type 2 certificates only apply to submission (outbound processing with
productId: "pl_Faktura__2.0") because offline mode only works when issuing invoices. You must configure Type 1 and Type 2 together for outbound submissions that support offline mode.
Wrong environment certificate
- Symptom
- Authentication fails after environment change.
- Solution
- Generate environment-specific certificates. Test certificates don't work in production.
Base64 encoding errors
- Symptom
- Invalid certificate format error, authentication fails immediately.
- Solution
Remove all line breaks from Base64 string.
Verify complete certificate was encoded (check file size).
Make sure both .crt and .key files are encoded separately.
Confirm no truncation occurred during copy/paste.
Missing certificate files
- Symptom
- Configuration accepted but authentication fails.
- Solution
Verify you have both .crt and .key files from KSeF portal.
Confirm both files are Base64 encoded.
Check that certificateCrtPassword matches the password set during certificate generation.
