Toss Login

Get AccessToken

post

This is an API that issues Access Token and Refresh Token from an Authorization Code. The validity period of the issued Access Token is 1 hour.

Business error code

The errors below respond with HTTP 200 and resultType: FAIL.

errorCode	Description
4050	It is not a mini app registered with the authentication server.
4095	The request limit has been exceeded. Please try again later.

This API can pass through the error codes of the connected internal system as is. Treat undocumented errorCode as a failure and refer to the reason message.

Request limit: 3,000 per minute per app

Authorizations

mutualTLS

This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the Use the server API document for how to issue and manage certificates.

Body

This is the request body for issuing an OAuth2 token.

authorizationCodestringRequired

This is the Authorization Code issued through the OAuth2 authentication process. This code is delivered as a query parameter in the redirect URL after user authentication is completed.

Example: SplxlOBeZQQYbYS6WxSbIA

referrerstringRequired

This is the acquisition channel through which the user entered the app. For example, it indicates which path was used to access this feature, such as a deep link, push notification, or in-app banner.

Example: deeplink

Responses

200

The request succeeded and the issued token information is returned.

application/json

or

400

The request body is not in the correct format. Check the field-by-field details in error.data.errorDetails.

application/json

500

This is an unclassified server error. If it keeps failing, please contact the partner support channel.

application/json

post/api-partner/v1/apps-in-toss/user/oauth2/generate-token

POST /api-partner/v1/apps-in-toss/user/oauth2/generate-token HTTP/1.1
Host: apps-in-toss-api.toss.im
Content-Type: application/json

{
  "authorizationCode": "SplxlOBeZQQYbYS6WxSbIA",
  "referrer": "deeplink"
}

{
  "resultType": "SUCCESS",
  "success": {
    "accessToken": "ya29.A0ARrdaM9bZxZJ...",
    "expiresIn": 3600,
    "refreshToken": "1//0gdfg23rF9sds...",
    "scope": "profile message:send",
    "tokenType": "Bearer"
  }
}

Get user information

get

This is an API that retrieves information about the logged-in user using the Access Token.

Business error code

The errors below respond with HTTP 200 and resultType: FAIL.

errorCode	Description
4010	Authentication information cannot be found.
4095	The request limit has been exceeded. Please try again later.

This API can pass through the error codes of the connected internal system as is. Treat undocumented errorCode as a failure and refer to the reason message.

Request limit: 3,000 per minute per app

Authorizations

mutualTLS

This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the Use the server API document for how to issue and manage certificates.

Header parameters

AuthorizationstringRequired

This is the value of the Authorization header containing the Access Token in Bearer format. The Access Token is issued via the Get AccessToken API.

Example: Bearer ya29.A0ARrdaM9bZxZJ...

Responses

200

The request succeeded and the retrieved user profile information is returned in the response. Some items may be null depending on whether the user has consented.

application/json

or

400

There is no Authorization header. error.data is an empty object, and error.reason is returned as Unknown Error.

application/json

500

This is an unclassified server error. If it keeps failing, please contact the partner support channel.

application/json

get/api-partner/v1/apps-in-toss/user/oauth2/login-me

GET /api-partner/v1/apps-in-toss/user/oauth2/login-me HTTP/1.1
Host: apps-in-toss-api.toss.im
Authorization: Bearer {accessToken}

{
  "resultType": "SUCCESS",
  "success": {
    "agreedTerms": [
      "tos_terms_1",
      "privacy_policy"
    ],
    "birthday": "19900101",
    "callingCode": "82",
    "ci": "aaf7cb53...",
    "di": "b712df83...",
    "email": "[e-mail]",
    "gender": "M",
    "name": "홍길동",
    "nationality": "KR",
    "phone": "1012345678",
    "scope": "profile message:send",
    "userKey": 123456789
  }
}

Get reissued AccessToken

post

This is an API that reissues an Access Token using a Refresh Token. The validity period of the Refresh Token is 14 days.

Business error code

The errors below respond with HTTP 200 and resultType: FAIL.

errorCode	Description
4050	It is not a mini app registered with the authentication server.
4095	The request limit has been exceeded. Please try again later.

This API can pass through the error codes of the connected internal system as is. Treat undocumented errorCode as a failure and refer to the reason message.

Request limit: 3,000 per minute per app

Authorizations

mutualTLS

This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the Use the server API document for how to issue and manage certificates.

Body

This is a request to reissue an access token using an existing refresh token.

refreshTokenstringRequired

This is the previously issued refresh token. You can request a new access token with this token.

Example: 1//0gdfg23rF9sds...

Responses

200

The request succeeded and information related to the reissued Access Token is returned.

application/json

or

400

The request body is not in the correct format. Check the field-by-field details in error.data.errorDetails.

application/json

500

This is an unclassified server error. If it keeps failing, please contact the partner support channel.

application/json

post/api-partner/v1/apps-in-toss/user/oauth2/refresh-token

POST /api-partner/v1/apps-in-toss/user/oauth2/refresh-token HTTP/1.1
Host: apps-in-toss-api.toss.im
Content-Type: application/json

{
  "refreshToken": "1//0gdfg23rF9sds..."
}

{
  "resultType": "SUCCESS",
  "success": {
    "accessToken": "ya29.A0ARrdaM9bZxZJ...",
    "expiresIn": 3600,
    "refreshToken": "1//0gdfg23rF9sds...",
    "scope": "profile message:send",
    "tokenType": "Bearer"
  }
}

Disconnect login connection with AccessToken

post

This is an API that disconnects the user's link using the Access Token in the Authorization header.

Business error code

The errors below respond with HTTP 200 and resultType: FAIL.

errorCode	Description
4050	It is not a mini app registered with the authentication server.
4010	Authentication information cannot be found.
4095	The request limit has been exceeded. Please try again later.

This API can pass through the error codes of the connected internal system as is. Treat undocumented errorCode as a failure and refer to the reason message.

Request limit: 3,000 per minute per app

Authorizations

mutualTLS

This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the Use the server API document for how to issue and manage certificates.

Header parameters

AuthorizationstringRequired

This is the value of the Authorization header containing the user's Access Token. The Access Token is issued via the Get AccessToken API.

Example: Bearer ya29.A0ARrdaM9bZxZJ...

Responses

200

The request succeeded and the connection for the user corresponding to the Access Token was successfully disconnected.

application/json

or

400

There is no Authorization header. error.data is an empty object, and error.reason is returned as Unknown Error.

application/json

500

This is an unclassified server error. If it keeps failing, please contact the partner support channel.

application/json

post/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-access-token

POST /api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-access-token HTTP/1.1
Host: apps-in-toss-api.toss.im
Authorization: Bearer {accessToken}

{
  "resultType": "SUCCESS",
  "success": {
    "userKey": 123456789
  }
}

Disconnect login connection with userKey

post

This is an API that disconnects the login connection for the user corresponding to userKey. The response includes only the userKey of the user whose connection was disconnected.

Business error code

The errors below respond with HTTP 200 and resultType: FAIL.

errorCode	Description
4050	It is not a mini app registered with the authentication server.
4095	The request limit has been exceeded. Please try again later.

This API can pass through the error codes of the connected internal system as is. Treat undocumented errorCode as a failure and refer to the reason message.

Request limit: 3,000 per minute per app

Authorizations

mutualTLS

This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the Use the server API document for how to issue and manage certificates.

Body

Request to disconnect OAuth2 user connection by UserKey

userKeyinteger · int64Required

This is the unique identifier of the user whose connection will be disconnected. It is used to identify the user in internal systems.

Example: 123456789

Responses

200

The request succeeded, and the userKey of the user whose connection was disconnected based on userKey is returned.

application/json

or

400

The request body is not in the correct format. Check the field-by-field details in error.data.errorDetails.

application/json

500

This is an unclassified server error. If it keeps failing, please contact the partner support channel.

application/json

post/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-user-key

POST /api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-user-key HTTP/1.1
Host: apps-in-toss-api.toss.im
Content-Type: application/json

{
  "userKey": 123456789
}

{
  "resultType": "SUCCESS",
  "success": {
    "userKey": 123456789
  }
}