How can we help?

Configure certificates in Sovos

Use the configuration API to configure your certificates in Sovos.

Create separate configurations for:

Use the same Type 1 certificate for both directions; only the productId differs.

Certificates reference

Certificate property reference

When you configure your certificates in Sovos, use the appropriate properties for your certificate format:

Certificate typeFormatRequired properties
Type 1 (Authentication)PEM

CertificateCrtBase64

CertificateCrtKeyBase64

CertificateCrtPassword

Type 2 (Offline)PEM

CertificateOfflineBase64

CertificateOfflineKeyBase64

CertificateOfflinePassword

Certificate expiration

Monitor certificate expiration dates and renew at least 30 days before expiration. Request new certificates through the KSeF portal before your current certificates expire.

API endpoint

POST https://api-test.sovos.com/v2/configurations/organizations/{orgId}/settings
Authorization: Bearer {accessToken}
Content-Type: application/json

Environment URLs

Key parameters

Every certificate configuration must include these scope parameters:
  • category: Always PL_INV for Poland

  • productId: pl_Faktura__2.0 (submission) or pl_Faktura_Polling_2.0 (polling)

  • workspaceId: Your Sovos workspace identifier

  • orgId: Your Sovos organization identifier

  • taxId: Your 10-digit NIP (optional but recommended)

Note:

Do not include operation parameter in certificate configurations. Operation is only used for token-based authentication.

Outbound configuration

Learn how to configure outbound settings for invoice submission using Sovos.

  1. Call the configuration endpoint using a POST request.

    Read more about the configuration API in the API reference.

    POST https://api-test.sovos.com/v2/configurations/organizations/{orgId}/settings
    Authorization: Bearer {accessToken}
    Content-Type: application/json
    
  2. Your request must include the key parameters, according to your configuration.
    This example shows the setup for Type 1 and Type 2 (optional) certificates; use this configuration when you need offline invoice issuance capability. You must include both types in the same API call.
    Note:

    Use productId: "pl_Faktura__2.0 for outbound processing.

    {
      "TaxId": "[YOUR_TAX_ID]",
      "PartnerCredentials": {
        // Type 1 authentication certificate
        "CertificateCrtBase64": "[Base64 encoded certificate]",
        "CertificateCrtKeyBase64": "[Base64 encoded private key]",
        "CertificateCrtPassword": "YourPassword",
        
        // Type 2 offline certificate
        "CertificateOfflineBase64": "[Base64 encoded certificate]",
        "CertificateOfflineKeyBase64": "[Base64 encoded private key]",
        "CertificateOfflinePassword": "YourOfflinePassword"
      },
      "Scope": {
        "workspaceId": "[YOUR_WORKSPACE_ID]",
        "orgId": "[YOUR_ORG_ID]",
        "category": "PL_INV",
        "productId": "pl_Faktura__2.0",
        "taxId": "[YOUR_TAX_ID]"
      }
    }

After completing these steps, you have the credentials needed to submit invoices to KSeF through Sovos.

Inbound configuration

Learn how to configure outbound settings for invoice polling using Sovos.

Key differences from outbound:
  • productId: Changes to pl_Faktura_Polling_2.0

  • Certificate: Use same Type 1 certificate files

  • Configuration: Create separate configuration (different API call)

Inbound polling does not need Type 2 offline certificate. Type 2 is only used during outbound submission for offline mode QR code generation.

  1. Call the configuration endpoint using a POST request.

    Read more about the configuration API in the API reference.

    POST https://api-test.sovos.com/v2/configurations/organizations/{orgId}/settings
    Authorization: Bearer {accessToken}
    Content-Type: application/json
    
  2. Your request must include the key parameters, according to your configuration.
    This example shows the setup for Type 1 certificate. Configure the same Type 1 certificate for invoice status polling and retrieval.
    Note:

    Use pl_Faktura_Polling_2.0 for inbound processing.

    {
      "TaxId": "[YOUR_TAX_ID]",
      "PartnerCredentials": {
        // Type 1 authentication certificate
        "CertificateCrtBase64": "[Same Type 1 .crt as outbound]",
        "CertificateCrtKeyBase64": "[Same Type 1 .key as outbound]",
        "CertificateCrtPassword": "YourPassword"
      },
      "Scope": {
        "workspaceId": "[YOUR_WORKSPACE_ID]",
        "orgId": "[YOUR_ORG_ID]",
        "category": "PL_INV",
        "productId": "pl_Faktura_Polling_2.0",
        "taxId": "[YOUR_TAX_ID]"
      }
    }

After completing these steps, you have the credentials needed to get invoices through Sovos.

Troubleshooting

This section presents solutions to common problems encountered during certificates configuration.

Missing or overwriting Type 1 when configuring offline

Symptom
All transmissions fail after adding Type 2.

This might occurs when you send a configuration API call with matching scope parameters (category, productId, workspaceId, orgId, taxId), the API completely replaces the existing configuration. If you only include Type 2 properties, you overwrite and remove your previously configured Type 1 certificate.

Solution
Configure Type 1 (authentication) and Type 2 (offline) in the same API call. Sending only Type 2 properties overwrites and removes Type 1.
Note:

Type 2 certificates only apply to submission (outbound processing with productId: "pl_Faktura__2.0") because offline mode only works when issuing invoices. You must configure Type 1 and Type 2 together for outbound submissions that support offline mode.

Wrong environment certificate

Symptom
Authentication fails after environment change.
Solution
Generate environment-specific certificates. Test certificates don't work in production.

Base64 encoding errors

Symptom
Invalid certificate format error, authentication fails immediately.
Solution
  • Remove all line breaks from Base64 string.

  • Verify complete certificate was encoded (check file size).

  • Make sure both .crt and .key files are encoded separately.

  • Confirm no truncation occurred during copy/paste.

Missing certificate files

Symptom
Configuration accepted but authentication fails.
Solution
  • Verify you have both .crt and .key files from KSeF portal.

  • Confirm both files are Base64 encoded.

  • Check that certificateCrtPassword matches the password set during certificate generation.