> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/api/en/toss-login.md). # Toss Login ## Get AccessToken > This is an API that issues Access Token and Refresh Token from an Authorization Code. The validity period of the issued Access Token is 1 hour.\ > \ > \### Business error code\ > \ > The errors below respond with HTTP 200 and \`resultType: FAIL\`.\ > \ > \| errorCode | Description |\ > \| --------- | --------------------------------------------------------------- |\ > \| \`4050\` | It is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through the error codes of the connected internal system as is. Treat undocumented \`errorCode\` as a failure and refer to the \`reason\` message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss partner API","version":"1.0.0"},"tags":[{"description":"This is an API that handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (simple login, message sending, Toss points payouts, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the [Use the server API](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-en/integration/server-api) document for how to issue and manage certificates.","type":"mutualTLS"}},"schemas":{"GenerateTokenRequest":{"description":"This is the request body for issuing an OAuth2 token.","properties":{"authorizationCode":{"description":"This is the Authorization Code issued through the OAuth2 authentication process. This code is delivered as a query parameter in the redirect URL after user authentication is completed.","type":"string"},"referrer":{"description":"This is the acquisition channel through which the user entered the app. For example, it indicates which path was used to access this feature, such as a deep link, push notification, or in-app banner.","type":"string"}},"required":["authorizationCode","referrer"],"type":"object"},"TossApiSuccessGenerateTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. If successful, it is `SUCCESS`.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/GenerateTokenResponse"}},"required":["resultType","success"],"type":"object"},"GenerateTokenResponse":{"description":"This is the response information for the OAuth2 token issuance request.","properties":{"accessToken":{"description":"This is the access token issued when the API call succeeds. Use this token by putting it in the Authorization header for API requests that require user authentication.","type":"string"},"expiresIn":{"description":"This is the access token's validity period in seconds. After this time, you must issue a new token with the refresh token.","format":"int64","type":"integer"},"refreshToken":{"description":"This is the refresh token used to reissue a token after the access token expires. You can request a new access token with this token.","type":"string"},"scope":{"description":"Indicates the scope of actions that can be performed with the token. For example, it may include permission to view user profiles or send messages.","type":"string"},"tokenType":{"description":"This indicates the token type. It is usually fixed to 'Bearer'.","type":"string"}},"required":["accessToken","expiresIn","refreshToken","scope","tokenType"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so be sure to check `resultType`.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-by-field validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-by-field validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for validation failure.","type":"string"},"rejectedValue":{"description":"This is the rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/generate-token":{"post":{"description":"This is an API that issues Access Token and Refresh Token from an Authorization Code. The validity period of the issued Access Token is 1 hour.\n\n### Business error code\n\nThe errors below respond with HTTP 200 and `resultType: FAIL`.\n\n| errorCode | Description |\n| --------- | --------------------------------------------------------------- |\n| `4050` | It is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through the error codes of the connected internal system as is. Treat undocumented `errorCode` as a failure and refer to the `reason` message.\n\n**Request limit**: 3,000 per minute per app","operationId":"generateOauth2Token","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateTokenRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessGenerateTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessGenerateTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded and the issued token information is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. Check the field-by-field details in `error.data.errorDetails`."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an unclassified server error. If it keeps failing, please contact the partner support channel."}},"summary":"Get AccessToken","tags":["toss-login"]}}}} ``` ## Get user information > This is an API that retrieves information about the logged-in user using the Access Token.\ > \ > \### Business error code\ > \ > The errors below respond with HTTP 200 and \`resultType: FAIL\`.\ > \ > \| errorCode | Description |\ > \| --------- | ------------------------------------------------------------ |\ > \| \`4010\` | Authentication information cannot be found. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through the error codes of the connected internal system as is. Treat undocumented \`errorCode\` as a failure and refer to the \`reason\` message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss partner API","version":"1.0.0"},"tags":[{"description":"This is an API that handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (simple login, message sending, Toss points payouts, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the [Use the server API](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-en/integration/server-api) document for how to issue and manage certificates.","type":"mutualTLS"}},"schemas":{"TossApiSuccessLoginMeResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. If successful, it is `SUCCESS`.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/LoginMeResponse"}},"required":["resultType","success"],"type":"object"},"LoginMeResponse":{"description":"OAuth2 login user information response","properties":{"agreedTerms":{"description":"This is the list of agreement IDs the user has consented to.","items":{"type":"string"},"type":"array"},"birthday":{"description":"This is the date of birth. It is an 8-digit string in YYYYMMDD format.","type":"string"},"callingCode":{"description":"This is the country calling code. For example, Korea is '82'.","type":"string"},"ci":{"description":"This is the CI (connection information) value. It is issued during identity verification.","type":"string"},"di":{"description":"This is the DI (duplicate registration confirmation information) value. It is used to verify whether it is the same user.","type":"string"},"email":{"description":"This is the email address. If you did not agree to provide it, it is null.","type":"string"},"gender":{"description":"This is gender information. It is one of 'M' (male) or 'F' (female).","type":"string"},"name":{"description":"This is the user's name. If you did not agree to provide the name, it is null.","type":"string"},"nationality":{"description":"This is the nationality code. For example, Korea is 'KR'.","type":"string"},"phone":{"description":"This is the phone number. It contains only numbers without the country code.","type":"string"},"scope":{"description":"This is the scope included in the token. Multiple scopes are separated by spaces.","type":"string"},"userKey":{"description":"This is the user's unique identifier.","format":"int64","type":"integer"}},"required":["agreedTerms","userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so be sure to check `resultType`.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-by-field validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-by-field validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for validation failure.","type":"string"},"rejectedValue":{"description":"This is the rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/login-me":{"get":{"description":"This is an API that retrieves information about the logged-in user using the Access Token.\n\n### Business error code\n\nThe errors below respond with HTTP 200 and `resultType: FAIL`.\n\n| errorCode | Description |\n| --------- | ------------------------------------------------------------ |\n| `4010` | Authentication information cannot be found. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through the error codes of the connected internal system as is. Treat undocumented `errorCode` as a failure and refer to the `reason` message.\n\n**Request limit**: 3,000 per minute per app","operationId":"loginMe","parameters":[{"description":"This is the value of the Authorization header containing the Access Token in Bearer format. The Access Token is issued via the [Get AccessToken](https://developers-apps-in-toss.toss.im/api/en/toss-login#post-api-partner-v1-apps-in-toss-user-oauth2-generate-token) API.","in":"header","name":"Authorization","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessLoginMeResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessLoginMeResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded and the retrieved user profile information is returned in the response. Some items may be `null` depending on whether the user has consented."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"There is no `Authorization` header. `error.data` is an empty object, and `error.reason` is returned as `Unknown Error`."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an unclassified server error. If it keeps failing, please contact the partner support channel."}},"summary":"Get user information","tags":["toss-login"]}}}} ``` ## Get reissued AccessToken > This is an API that reissues an Access Token using a Refresh Token. The validity period of the Refresh Token is 14 days.\ > \ > \### Business error code\ > \ > The errors below respond with HTTP 200 and \`resultType: FAIL\`.\ > \ > \| errorCode | Description |\ > \| --------- | --------------------------------------------------------------- |\ > \| \`4050\` | It is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through the error codes of the connected internal system as is. Treat undocumented \`errorCode\` as a failure and refer to the \`reason\` message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss partner API","version":"1.0.0"},"tags":[{"description":"This is an API that handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (simple login, message sending, Toss points payouts, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the [Use the server API](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-en/integration/server-api) document for how to issue and manage certificates.","type":"mutualTLS"}},"schemas":{"RefreshTokenRequest":{"description":"This is a request to reissue an access token using an existing refresh token.","properties":{"refreshToken":{"description":"This is the previously issued refresh token. You can request a new access token with this token.","type":"string"}},"required":["refreshToken"],"type":"object"},"TossApiSuccessRefreshTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. If successful, it is `SUCCESS`.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/RefreshTokenResponse"}},"required":["resultType","success"],"type":"object"},"RefreshTokenResponse":{"description":"OAuth2 token refresh response","properties":{"accessToken":{"description":"This is the newly issued access token.","type":"string"},"expiresIn":{"description":"This is the expiration time of the access token (in seconds).","format":"int64","type":"integer"},"refreshToken":{"description":"This is the newly issued refresh token.","type":"string"},"scope":{"description":"This is the access token scope. E.g., viewing user profiles, sending messages, etc.","type":"string"},"tokenType":{"description":"This is the token type. It is usually fixed as 'Bearer'.","type":"string"}},"required":["accessToken","expiresIn","refreshToken","scope","tokenType"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so be sure to check `resultType`.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-by-field validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-by-field validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for validation failure.","type":"string"},"rejectedValue":{"description":"This is the rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/refresh-token":{"post":{"description":"This is an API that reissues an Access Token using a Refresh Token. The validity period of the Refresh Token is 14 days.\n\n### Business error code\n\nThe errors below respond with HTTP 200 and `resultType: FAIL`.\n\n| errorCode | Description |\n| --------- | --------------------------------------------------------------- |\n| `4050` | It is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through the error codes of the connected internal system as is. Treat undocumented `errorCode` as a failure and refer to the `reason` message.\n\n**Request limit**: 3,000 per minute per app","operationId":"refreshOauth2Token","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RefreshTokenRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessRefreshTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessRefreshTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded and information related to the reissued Access Token is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. Check the field-by-field details in `error.data.errorDetails`."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an unclassified server error. If it keeps failing, please contact the partner support channel."}},"summary":"Get reissued AccessToken","tags":["toss-login"]}}}} ``` ## Disconnect login connection with AccessToken > This is an API that disconnects the user's link using the Access Token in the Authorization header.\ > \ > \### Business error code\ > \ > The errors below respond with HTTP 200 and \`resultType: FAIL\`.\ > \ > \| errorCode | Description |\ > \| --------- | --------------------------------------------------------------- |\ > \| \`4050\` | It is not a mini app registered with the authentication server. |\ > \| \`4010\` | Authentication information cannot be found. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through the error codes of the connected internal system as is. Treat undocumented \`errorCode\` as a failure and refer to the \`reason\` message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss partner API","version":"1.0.0"},"tags":[{"description":"This is an API that handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (simple login, message sending, Toss points payouts, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the [Use the server API](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-en/integration/server-api) document for how to issue and manage certificates.","type":"mutualTLS"}},"schemas":{"TossApiSuccessDisconnectUserByAccessTokenResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. If successful, it is `SUCCESS`.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/DisconnectUserByAccessTokenResponse"}},"required":["resultType","success"],"type":"object"},"DisconnectUserByAccessTokenResponse":{"description":"Disconnects the user using the user's OAuth2 access token. This API is mainly used when the user wants to disconnect on their own.","properties":{"userKey":{"description":"This is the unique userKey value of the disconnected user. This value is used to identify the user in internal systems.","format":"int64","type":"integer"}},"required":["userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so be sure to check `resultType`.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-by-field validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-by-field validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for validation failure.","type":"string"},"rejectedValue":{"description":"This is the rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-access-token":{"post":{"description":"This is an API that disconnects the user's link using the Access Token in the Authorization header.\n\n### Business error code\n\nThe errors below respond with HTTP 200 and `resultType: FAIL`.\n\n| errorCode | Description |\n| --------- | --------------------------------------------------------------- |\n| `4050` | It is not a mini app registered with the authentication server. |\n| `4010` | Authentication information cannot be found. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through the error codes of the connected internal system as is. Treat undocumented `errorCode` as a failure and refer to the `reason` message.\n\n**Request limit**: 3,000 per minute per app","operationId":"removeByAccessToken","parameters":[{"description":"This is the value of the Authorization header containing the user's Access Token. The Access Token is issued via the [Get AccessToken](https://developers-apps-in-toss.toss.im/api/en/toss-login#post-api-partner-v1-apps-in-toss-user-oauth2-generate-token) API.","in":"header","name":"Authorization","required":true,"schema":{"type":"string"}}],"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessDisconnectUserByAccessTokenResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessDisconnectUserByAccessTokenResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded and the connection for the user corresponding to the Access Token was successfully disconnected."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"There is no `Authorization` header. `error.data` is an empty object, and `error.reason` is returned as `Unknown Error`."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an unclassified server error. If it keeps failing, please contact the partner support channel."}},"summary":"Disconnect login connection with AccessToken","tags":["toss-login"]}}}} ``` ## Disconnect login connection with userKey > This is an API that disconnects the login connection for the user corresponding to userKey. The response includes only the \`userKey\` of the user whose connection was disconnected.\ > \ > \### Business error code\ > \ > The errors below respond with HTTP 200 and \`resultType: FAIL\`.\ > \ > \| errorCode | Description |\ > \| --------- | --------------------------------------------------------------- |\ > \| \`4050\` | It is not a mini app registered with the authentication server. |\ > \| \`4095\` | The request limit has been exceeded. Please try again later. |\ > \ > This API can pass through the error codes of the connected internal system as is. Treat undocumented \`errorCode\` as a failure and refer to the \`reason\` message.\ > \ > \*\*Request limit\*\*: 3,000 per minute per app ```json {"openapi":"3.1.0","info":{"title":"Apps in Toss partner API","version":"1.0.0"},"tags":[{"description":"This is an API that handles OAuth2-based app integration and user authentication.","name":"toss-login"}],"servers":[{"description":"Operations (simple login, message sending, Toss points payouts, etc.)","url":"https://apps-in-toss-api.toss.im"}],"security":[{"mutualTLS":[]}],"components":{"securitySchemes":{"mutualTLS":{"description":"This is client-certificate-based mTLS authentication issued to the partner. The mini app is identified by the certificate's CN. Refer to the [Use the server API](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-en/integration/server-api) document for how to issue and manage certificates.","type":"mutualTLS"}},"schemas":{"DisconnectUserByUserKeyRequest":{"description":"Request to disconnect OAuth2 user connection by UserKey","properties":{"userKey":{"description":"This is the unique identifier of the user whose connection will be disconnected. It is used to identify the user in internal systems.","format":"int64","type":"integer"}},"required":["userKey"],"type":"object"},"TossApiSuccessDisconnectUserByUserKeyResponse":{"description":"This is the success response envelope.","properties":{"resultType":{"description":"This is the processing result. If successful, it is `SUCCESS`.","enum":["SUCCESS"],"type":"string"},"success":{"$ref":"#/components/schemas/DisconnectUserByUserKeyResponse"}},"required":["resultType","success"],"type":"object"},"DisconnectUserByUserKeyResponse":{"description":"Response for OAuth2 user connection disconnection by UserKey","properties":{"userKey":{"description":"This is the unique identifier of the disconnected user. It is the same as the value used in the request.","format":"int64","type":"integer"}},"required":["userKey"]},"TossApiFail":{"description":"This is the failure response envelope. Business errors are returned with HTTP 200, so be sure to check `resultType`.","properties":{"error":{"$ref":"#/components/schemas/TossApiError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiValidationFail":{"description":"This is the response when request field validation fails.","properties":{"error":{"$ref":"#/components/schemas/TossApiValidationFailError"},"resultType":{"description":"This is the processing result. Treat any value other than `SUCCESS` as a failure. It is usually `FAIL`.","enum":["FAIL","HTTP_TIMEOUT","NETWORK_ERROR","EXECUTION_FAIL","INTERRUPTED","INTERNAL_ERROR"],"type":"string"},"success":{"description":"It is always null on failure."}},"required":["error","resultType"],"type":"object"},"TossApiValidationFailError":{"description":"This is detailed error information.","properties":{"data":{"description":"This is additional error information. When the request limit is exceeded, `retryAfterSeconds` is included.","properties":{"errorDetails":{"description":"This is a detailed list of field-by-field validation failures.","items":{"$ref":"#/components/schemas/TossApiFieldError"},"type":"array"}},"type":"object"},"errorCode":{"description":"This is the error code. Refer to each API's business error code table.","type":"string"},"errorType":{"description":"This is the internal error classification value. Use `errorCode` for error categorization.","format":"int32","type":"integer"},"reason":{"description":"This is a human-readable error description.","type":"string"},"title":{"description":"This is the error title. It is usually null.","type":"string"}},"required":["errorCode","reason"],"type":"object"},"TossApiFieldError":{"description":"This is a detailed list of field-by-field validation failures.","properties":{"field":{"description":"This is the name of the field that failed validation.","type":"string"},"message":{"description":"This is the reason for validation failure.","type":"string"},"rejectedValue":{"description":"This is the rejected input value."}},"type":"object"}}},"paths":{"/api-partner/v1/apps-in-toss/user/oauth2/access/remove-by-user-key":{"post":{"description":"This is an API that disconnects the login connection for the user corresponding to userKey. The response includes only the `userKey` of the user whose connection was disconnected.\n\n### Business error code\n\nThe errors below respond with HTTP 200 and `resultType: FAIL`.\n\n| errorCode | Description |\n| --------- | --------------------------------------------------------------- |\n| `4050` | It is not a mini app registered with the authentication server. |\n| `4095` | The request limit has been exceeded. Please try again later. |\n\nThis API can pass through the error codes of the connected internal system as is. Treat undocumented `errorCode` as a failure and refer to the `reason` message.\n\n**Request limit**: 3,000 per minute per app","operationId":"removeByUserKey","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DisconnectUserByUserKeyRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"discriminator":{"mapping":{"FAIL":"#/components/schemas/TossApiFail","SUCCESS":"#/components/schemas/TossApiSuccessDisconnectUserByUserKeyResponse"},"propertyName":"resultType"},"oneOf":[{"$ref":"#/components/schemas/TossApiSuccessDisconnectUserByUserKeyResponse"},{"$ref":"#/components/schemas/TossApiFail"}]}}},"description":"The request succeeded, and the `userKey` of the user whose connection was disconnected based on `userKey` is returned."},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiValidationFail"}}},"description":"The request body is not in the correct format. Check the field-by-field details in `error.data.errorDetails`."},"500":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TossApiFail"}}},"description":"This is an unclassified server error. If it keeps failing, please contact the partner support channel."}},"summary":"Disconnect login connection with userKey","tags":["toss-login"]}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://developers-apps-in-toss.toss.im/api/en/toss-login.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.