Authentication

mTLS certificate and user authentication header guide

This explains the authentication method for the Mini App partner server API.

All APIs identify the caller (the mini app) with an mTLS (mutual TLS) client certificate.

mTLS authentication happens during the TLS connection establishment phase, so it does not appear in request headers. As in the code examples (cURL·Python·Node.js) in each API document, you need to configure the issued certificate and private key file together with the request.

For operational information such as firewall IP allowlists, mTLS certificate issuance and management, and request limits, refer to the server API usage document.

Depending on the endpoint, user-level APIs must include one of the values below.

• x-toss-user-key header — user key issued through Toss Login (obtained via the Get User Info API)
• x-anon-key header — anonymous user identification key (issued by the mini app SDK User.getAnonymousKey function)
• Authorization: Bearer {accessToken} header — Toss Login Access Token (issued by the Get AccessToken API, some login APIs)