KSeF-app

1. What it is

2. The hard parts

• Getting in at all KSeF does not accept a password. Authentication is a chain: request a challenge, encrypt it, submit it, poll for the outcome every two seconds until a token is issued, then redeem and refresh that token. Two separate certificates are involved.
• Cryptography you cannot skip Key exchange uses RSA-OAEP with SHA-256; payloads use AES-256-CBC with PKCS#7 padding; and the key identifier is the base64 of the SHA-256 of the certificate's DER form. Every step has to be exactly right or the request is simply rejected.
• Twenty thousand invoices, ninety days at a time Each query is capped to a 90-day window and truncated past 10,000 records or 1 GB. The syncer walks the windows and resumes from a high-water mark when a result was truncated — so a large archive converges instead of quietly losing a slice.
• Exports that are portable but not readable An export is packaged as a ZIP with a random AES key, wrapped by the recipient's certificate, plus a metadata file. The archive can leave the machine without being readable in transit.
• Staying inside the rate limits Every API group has its own budget. Push too hard and the system throttles you — and a sync that retries blindly only makes it worse, so requests are paced per group rather than globally.

3. Notes

• Parses FA(3) invoice XML, and can issue invoices in offline mode when the connection is down.
• Storage sits behind an interface built for PostgreSQL, so the filesystem backend can be replaced without touching the sync logic.

4. Contact

Something to build, fix or hook up? Write — replies usually land within a day, EU timezone.