Secure storage of KSeF tokens and integration keys

A KSeF token lets you issue and read invoices on behalf of the company. Keys to Allegro, a shop or a courier give access to orders and shipments. These are secrets with financial consequences, so treat them as carefully as a bank password.

On the system's side

• Encryption before saving to the database, with the key stored outside the database.
• No read-back: after saving, the secret never returns to the browser or to an interface response. It can only be replaced with a new one.
• No secrets in logs or error reports: sensitive data is removed from the context before it reaches support.
• OAuth tokens are refreshed on the server side, with refresh tokens stored encrypted.

On the company's side

• Generate your own token for the company tax ID and grant only the permissions you need (for example issuing and reading invoices).
• Choose the environment explicitly (test, DEMO, production) and try the test one first.
• Integration keys are entered by a person with permission to edit company data; the rest of the team cannot see them.
• When the responsible person changes, generate a new token and revoke the old one.

Your own keys to the Zaksio interface

A key to the public interface is visible only at the moment of creation. You can restrict it with scopes, an allowed IP list and an expiry date, rotate it with a transition period and revoke it at any time. Key changes require extra confirmation with a password, a 2FA code or an e-mail code.