> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/api/en/toss-login.md). # Toss Login ## Get AccessToken > This API issues an Access Token and Refresh Token using an Authorization Code. The issued Access Token is valid for 1 hour.\ > \ > \### Business error code\ > \ > The errors below return HTTP 200 and \`resultType: FAIL\` respond with it.\ > \ > \| errorCode | Description |\ > \| --------- | ----------------------------------------------------------------- |\ > \| \`4050\` | This is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through error codes from the connected internal system as-is. Undocumented \`errorCode\` is treated as a failure, and \`reason\` please refer to the message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss Partner API","version":"1.0.0"},"tags":[{"description":"This API handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (for simple login, message sending, Toss Points payout, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is mTLS authentication based on a client certificate issued to the partner. The mini app is identified by the certificate's CN. For how to issue and manage certificates, [Using the server API](https://developers-apps-in-toss.toss.im/documentation/integration/server-api) please refer to the documentation.","type":"mutualTLS"}},"schemas":{"GenerateTokenRequest":{"description":"This is the request body for issuing an OAuth2 token.","properties":{"authorizationCode":{"description":"This is the Authorization Code issued through the OAuth2 authentication process. After user authentication is completed, this code is passed as a query parameter to the redirect URL.","type":"string"},"referrer":{"description":"This is the entry path by which the user entered the app. For example, it means which path was used to access this feature, such as a deep link, push notification, or in-app banner.","type":"string"}},"required":["authorizationCode","referrer"],"type":"object"},"TossApiSuccessGenerateTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. On success, `SUCCESS` it is.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/GenerateTokenResponse"}},"required":["resultType","success"],"type":"object"},"GenerateTokenResponse":{"description":"This is the response information for the OAuth2 token issuance request.","properties":{"accessToken":{"description":"This is the access token issued when the API call succeeds. Use this token by putting it in the Authorization header when making API requests that require user authentication.","type":"string"},"expiresIn":{"description":"This is the access token validity period in seconds. After this period, you must issue a new token using the refresh token.","format":"int64","type":"integer"},"refreshToken":{"description":"This is the refresh token used to reissue a token after the access token expires. You can request a new access token with this token.","type":"string"},"scope":{"description":"Indicates the scope of actions that can be performed with the token. For example, it may include permission to retrieve user profiles or send messages.","type":"string"},"tokenType":{"description":"Indicates the token type. It is usually fixed as 'Bearer'.","type":"string"}},"required":["accessToken","expiresIn","refreshToken","scope","tokenType"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so `resultType` be sure to check it.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-level validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-level validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for the validation failure.","type":"string"},"rejectedValue":{"description":"This is a rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/generate-token":{"post":{"description":"This API issues an Access Token and Refresh Token using an Authorization Code. The issued Access Token is valid for 1 hour.\n\n### Business error code\n\nThe errors below return HTTP 200 and `resultType: FAIL` respond with it.\n\n| errorCode | Description |\n| --------- | ----------------------------------------------------------------- |\n| `4050` | This is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through error codes from the connected internal system as-is. Undocumented `errorCode` is treated as a failure, and `reason` please refer to the message.\n\n**Request limit**: 3,000 per minute per app","operationId":"generateOauth2Token","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateTokenRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessGenerateTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessGenerateTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and the issued token information is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. `error.data.errorDetails` Check the detailed information for each field below."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an uncategorized server error. If it keeps failing, contact the partner support channel."}},"summary":"Get AccessToken","tags":["toss-login"]}}}} ``` ## Get user information > This API retrieves information about the logged-in user using an Access Token.\ > \ > \### Business error code\ > \ > The errors below return HTTP 200 and \`resultType: FAIL\` respond with it.\ > \ > \| errorCode | Description |\ > \| --------- | ------------------------------------------------------------ |\ > \| \`4010\` | Authentication information could not be found. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through error codes from the connected internal system as-is. Undocumented \`errorCode\` is treated as a failure, and \`reason\` please refer to the message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss Partner API","version":"1.0.0"},"tags":[{"description":"This API handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (for simple login, message sending, Toss Points payout, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is mTLS authentication based on a client certificate issued to the partner. The mini app is identified by the certificate's CN. For how to issue and manage certificates, [Using the server API](https://developers-apps-in-toss.toss.im/documentation/integration/server-api) please refer to the documentation.","type":"mutualTLS"}},"schemas":{"TossApiSuccessLoginMeResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. On success, `SUCCESS` it is.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/LoginMeResponse"}},"required":["resultType","success"],"type":"object"},"LoginMeResponse":{"description":"OAuth2 logged-in user information response","properties":{"agreedTerms":{"description":"This is the list of terms IDs the user has agreed to.","items":{"type":"string"},"type":"array"},"birthday":{"description":"This is the date of birth. It is an 8-digit string in YYYYMMDD format.","type":"string"},"callingCode":{"description":"This is the country calling code. For example, South Korea is '82'.","type":"string"},"ci":{"description":"This is the CI (connection information) value. It is issued during identity verification.","type":"string"},"di":{"description":"This is the DI (duplicate registration confirmation information) value. It is used to verify whether it is the same user.","type":"string"},"email":{"description":"This is the email address. If you did not consent to provide it, it is null.","type":"string"},"gender":{"description":"This is gender information. It is one of 'M' (male) or 'F' (female).","type":"string"},"name":{"description":"This is the user's name. If you did not consent to provide the name, it is null.","type":"string"},"nationality":{"description":"This is the nationality code. For example, South Korea is 'KR'.","type":"string"},"phone":{"description":"This is the phone number. It contains only numbers, without the country code.","type":"string"},"scope":{"description":"These are the scopes included in the token. Multiple scopes are separated by spaces.","type":"string"},"userKey":{"description":"This is the user's unique identifier.","format":"int64","type":"integer"}},"required":["agreedTerms","userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so `resultType` be sure to check it.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-level validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-level validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for the validation failure.","type":"string"},"rejectedValue":{"description":"This is a rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/login-me":{"get":{"description":"This API retrieves information about the logged-in user using an Access Token.\n\n### Business error code\n\nThe errors below return HTTP 200 and `resultType: FAIL` respond with it.\n\n| errorCode | Description |\n| --------- | ------------------------------------------------------------ |\n| `4010` | Authentication information could not be found. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through error codes from the connected internal system as-is. Undocumented `errorCode` is treated as a failure, and `reason` please refer to the message.\n\n**Request limit**: 3,000 per minute per app","operationId":"loginMe","parameters":[{"description":"This is the value of the Authorization header containing a Bearer-type Access Token. The Access Token is [Get AccessToken](https://developers-apps-in-toss.toss.im/documentation/api/toss-login#post-api-partner-v1-apps-in-toss-user-oauth2-generate-token) issued via the API.","in":"header","name":"Authorization","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessLoginMeResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessLoginMeResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and the retrieved user profile information is returned in the response. Some fields, depending on whether the user has consented, `null` may be null."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"`Authorization` header is missing. `error.data` is an empty object, and `error.reason` is `Unknown Error` is returned."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an uncategorized server error. If it keeps failing, contact the partner support channel."}},"summary":"Get user information","tags":["toss-login"]}}}} ``` ## Reissue AccessToken > This API reissues an Access Token using a Refresh Token. The Refresh Token is valid for 14 days.\ > \ > \### Business error code\ > \ > The errors below return HTTP 200 and \`resultType: FAIL\` respond with it.\ > \ > \| errorCode | Description |\ > \| --------- | ----------------------------------------------------------------- |\ > \| \`4050\` | This is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through error codes from the connected internal system as-is. Undocumented \`errorCode\` is treated as a failure, and \`reason\` please refer to the message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss Partner API","version":"1.0.0"},"tags":[{"description":"This API handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (for simple login, message sending, Toss Points payout, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is mTLS authentication based on a client certificate issued to the partner. The mini app is identified by the certificate's CN. For how to issue and manage certificates, [Using the server API](https://developers-apps-in-toss.toss.im/documentation/integration/server-api) please refer to the documentation.","type":"mutualTLS"}},"schemas":{"RefreshTokenRequest":{"description":"This is a request to reissue an access token using an existing refresh token.","properties":{"refreshToken":{"description":"This is an existing refresh token. You can request a new access token with this token.","type":"string"}},"required":["refreshToken"],"type":"object"},"TossApiSuccessRefreshTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. On success, `SUCCESS` it is.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/RefreshTokenResponse"}},"required":["resultType","success"],"type":"object"},"RefreshTokenResponse":{"description":"OAuth2 token refresh response","properties":{"accessToken":{"description":"This is the newly issued access token.","type":"string"},"expiresIn":{"description":"This is the expiration time of the access token (in seconds).","format":"int64","type":"integer"},"refreshToken":{"description":"This is the newly issued refresh token.","type":"string"},"scope":{"description":"This is the scope of the access token. For example: viewing user profiles, sending messages, etc.","type":"string"},"tokenType":{"description":"This is the token type. It is usually fixed as 'Bearer'.","type":"string"}},"required":["accessToken","expiresIn","refreshToken","scope","tokenType"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so `resultType` be sure to check it.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-level validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-level validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for the validation failure.","type":"string"},"rejectedValue":{"description":"This is a rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/refresh-token":{"post":{"description":"This API reissues an Access Token using a Refresh Token. The Refresh Token is valid for 14 days.\n\n### Business error code\n\nThe errors below return HTTP 200 and `resultType: FAIL` respond with it.\n\n| errorCode | Description |\n| --------- | ----------------------------------------------------------------- |\n| `4050` | This is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through error codes from the connected internal system as-is. Undocumented `errorCode` is treated as a failure, and `reason` please refer to the message.\n\n**Request limit**: 3,000 per minute per app","operationId":"refreshOauth2Token","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshTokenRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessRefreshTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessRefreshTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and information related to the reissued Access Token is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. `error.data.errorDetails` Check the detailed information for each field below."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an uncategorized server error. If it keeps failing, contact the partner support channel."}},"summary":"Reissue AccessToken","tags":["toss-login"]}}}} ``` ## Disconnect login connection with AccessToken > This API disconnects the specified user's connection using the Access Token in the Authorization header.\ > \ > \### Business error code\ > \ > The errors below return HTTP 200 and \`resultType: FAIL\` respond with it.\ > \ > \| errorCode | Description |\ > \| --------- | ----------------------------------------------------------------- |\ > \| \`4050\` | This is not a mini app registered with the authentication server. |\ > \| \`4010\` | Authentication information could not be found. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through error codes from the connected internal system as-is. Undocumented \`errorCode\` is treated as a failure, and \`reason\` please refer to the message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss Partner API","version":"1.0.0"},"tags":[{"description":"This API handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (for simple login, message sending, Toss Points payout, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is mTLS authentication based on a client certificate issued to the partner. The mini app is identified by the certificate's CN. For how to issue and manage certificates, [Using the server API](https://developers-apps-in-toss.toss.im/documentation/integration/server-api) please refer to the documentation.","type":"mutualTLS"}},"schemas":{"TossApiSuccessDisconnectUserByAccessTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. On success, `SUCCESS` it is.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/DisconnectUserByAccessTokenResponse"}},"required":["resultType","success"],"type":"object"},"DisconnectUserByAccessTokenResponse":{"description":"Disconnect the user's connection using the user's OAuth2 Access Token. This API is mainly used when the user wants to disconnect on their own.","properties":{"userKey":{"description":"This is the unique userKey value of the disconnected user. This value is used to identify the user in internal systems.","format":"int64","type":"integer"}},"required":["userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so `resultType` be sure to check it.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-level validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-level validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for the validation failure.","type":"string"},"rejectedValue":{"description":"This is a rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-access-token":{"post":{"description":"This API disconnects the specified user's connection using the Access Token in the Authorization header.\n\n### Business error code\n\nThe errors below return HTTP 200 and `resultType: FAIL` respond with it.\n\n| errorCode | Description |\n| --------- | ----------------------------------------------------------------- |\n| `4050` | This is not a mini app registered with the authentication server. |\n| `4010` | Authentication information could not be found. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through error codes from the connected internal system as-is. Undocumented `errorCode` is treated as a failure, and `reason` please refer to the message.\n\n**Request limit**: 3,000 per minute per app","operationId":"removeByAccessToken","parameters":[{"description":"This is the value of the Authorization header containing the user's Access Token. The Access Token is [Get AccessToken](https://developers-apps-in-toss.toss.im/documentation/api/toss-login#post-api-partner-v1-apps-in-toss-user-oauth2-generate-token) issued via the API.","in":"header","name":"Authorization","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessDisconnectUserByAccessTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessDisconnectUserByAccessTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and the connection of the user corresponding to the Access Token was successfully disconnected."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"`Authorization` header is missing. `error.data` is an empty object, and `error.reason` is `Unknown Error` is returned."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an uncategorized server error. If it keeps failing, contact the partner support channel."}},"summary":"Disconnect login connection with AccessToken","tags":["toss-login"]}}}} ``` ## Disconnect login connection with userKey > This API disconnects the specified user's login connection using userKey. The response includes the disconnected user's \`userKey\` userKey only.\ > \ > \### Business error code\ > \ > The errors below return HTTP 200 and \`resultType: FAIL\` respond with it.\ > \ > \| errorCode | Description |\ > \| --------- | ----------------------------------------------------------------- |\ > \| \`4050\` | This is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through error codes from the connected internal system as-is. Undocumented \`errorCode\` is treated as a failure, and \`reason\` please refer to the message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss Partner API","version":"1.0.0"},"tags":[{"description":"This API handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (for simple login, message sending, Toss Points payout, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is mTLS authentication based on a client certificate issued to the partner. The mini app is identified by the certificate's CN. For how to issue and manage certificates, [Using the server API](https://developers-apps-in-toss.toss.im/documentation/integration/server-api) please refer to the documentation.","type":"mutualTLS"}},"schemas":{"DisconnectUserByUserKeyRequest":{"description":"OAuth2 user disconnection request by UserKey","properties":{"userKey":{"description":"This is the user's unique identifier to disconnect. It is used to identify the user in internal systems.","format":"int64","type":"integer"}},"required":["userKey"],"type":"object"},"TossApiSuccessDisconnectUserByUserKeyResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. On success, `SUCCESS` it is.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/DisconnectUserByUserKeyResponse"}},"required":["resultType","success"],"type":"object"},"DisconnectUserByUserKeyResponse":{"description":"OAuth2 user disconnection response by UserKey","properties":{"userKey":{"description":"This is the unique identifier of the disconnected user. It is the same as the value used in the request.","format":"int64","type":"integer"}},"required":["userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so `resultType` be sure to check it.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. `SUCCESS` Treat all values other than `FAIL` as failure. Generally,","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"Additional error information. When the request limit is exceeded `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-level validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is an internal error classification value. For error categorization, `errorCode` use it.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-level validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for the validation failure.","type":"string"},"rejectedValue":{"description":"This is a rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-user-key":{"post":{"description":"This API disconnects the specified user's login connection using userKey. The response includes the disconnected user's `userKey` userKey only.\n\n### Business error code\n\nThe errors below return HTTP 200 and `resultType: FAIL` respond with it.\n\n| errorCode | Description |\n| --------- | ----------------------------------------------------------------- |\n| `4050` | This is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through error codes from the connected internal system as-is. Undocumented `errorCode` is treated as a failure, and `reason` please refer to the message.\n\n**Request limit**: 3,000 per minute per app","operationId":"removeByUserKey","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectUserByUserKeyRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessDisconnectUserByUserKeyResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessDisconnectUserByUserKeyResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and `userKey` based on it, the disconnected user's `userKey` is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. `error.data.errorDetails` Check the detailed information for each field below."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an uncategorized server error. If it keeps failing, contact the partner support channel."}},"summary":"Disconnect login connection with userKey","tags":["toss-login"]}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://developers-apps-in-toss.toss.im/api/en/toss-login.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.