Using the Server API

This guide covers the server communication settings required before using the Apps in Toss API.

Get a server mTLS certificate

To use the Apps in Toss API, you must mTLS (mutual Transport Layer Security, bidirectional transport layer security) set up a certificate.

mTLS is a method where the client and server verify each other's identities. Standard HTTPS only authenticates the server, but mTLS the partner company's server and the Apps in Toss server authenticate each other.

Setting up this certificate ensures the following:

• Encryption of the communication channel
• Only approved servers can call the API
• Prevention of tampering

Manage issued certificates as follows.

• Store the certificate and key files securely so they are not leaked.
• Reissue the certificate before it expires.
• If you need a zero-downtime replacement, you can register two or more certificates in advance.

If you have not prepared a certificate yet, first check the mTLS certificate issuance method in the Get a server mTLS certificate document.

Check communication firewalls

If you manage Inbound and Outbound firewalls on your server, you must allow the IPs and ports below. If you do not, API calls may fail or you may not receive callbacks.

Inbound IP the merchant must allow

Apps in Toss → merchant

IP	Port
117.52.3.11	443
211.115.96.11	443
106.249.5.11	443
117.52.3.80~87	443
211.115.96.80~87	443
106.249.5.80~87	443

This is the IP used when Apps in Toss sends requests to the merchant server. For example, it is needed when receiving subscription status change callbacks or data provision consent withdrawal callbacks through the callback URL registered in the console.

Outbound IP the merchant must allow

merchant → Apps in Toss

Feature	Domain	IP	Port
Easy login, message sending, Toss points rewards	apps-in-toss-api.toss.im	117.52.3.192, 211.115.96.192, 106.249.5.192	443
Easy payment	pay-apps-in-toss-api.toss.im	117.52.3.195, 211.115.96.195, 106.249.5.195	443

These are the settings required when calling the Apps in Toss API from the merchant server. You must open HTTPS port 443 to communicate properly.

Allow CORS

To communicate with the server from a mini app, you need to add the mini app Origin to the server's allowed CORS Origin. The Origin you need to allow depends on the SDK version and the effective date.

SDK 3.x

SDK 3.x Origin change guide

From SDK 3.x bundles uploaded after Tuesday, August 25, 2026, service is provided using the Origin used in SDK 2.x. If you communicate with external servers, please add the Origin below to the server's allowed CORS Origin.

• https://<appName>.apps.tossmini.com : production environment
• https://<appName>.private-apps.tossmini.com : console QR test environment

• https://<appName>.web.tossmini.com : production environment
• https://<appName>.private-web.tossmini.com : console QR test environment

SDK 1.x ~ 2.x

• https://<appName>.apps.tossmini.com : production environment
• https://<appName>.private-apps.tossmini.com : console QR test environment

Common API specifications

Domain information

• https://apps-in-toss-api.toss.im
• https://pay-apps-in-toss-api.toss.im

Common API response format

All APIs use a common response structure. resultType First check success or failure by the value.

Success response

{
  "resultType": "SUCCESS",
  "success": {
    "sample": "data"
  }
}

• resultTypeIf it is "SUCCESS"means the request was processed successfully.
• The actual response data is success inside the object.
• For each API, success the internal structure differs.

Failure response

{
  "resultType": "FAIL",
  "error": {
    "errorCode": "INVALID_PARAMETER",
    "reason": "The request failed."
  }
}

• resultTypeIf it is "FAIL"means the request processing failed.
• errorCodeis a code that indicates the type of error.
• reasoncontains a human-readable error description.
• If you send invalid parameters, INVALID_PARAMETERan error is returned with a code such as

When processing responses, be sure to resultTypecheck it first, then implement separate success and failure logic.

Request limit policy

The Apps in Toss API limits the number of requests to ensure stable service operation.

Default limit

• 3,000 QPM per minute
• QPM stands for Queries Per Minute and means the number of API requests that can be made per minute.
• For mini apps, you can make up to 3,000 requests per minute.

If you exceed this limit, additional requests may be blocked for a certain period of time.

When a higher QPM is needed

If you need more requests than the default 3,000 QPM Channel Talkyou can request an increase through

When requesting, please provide the following information as well.

• Purpose of use
• Expected traffic volume
• Request volume during peak hours

We adjust the limit after reviewing the business purpose and traffic volume. If large traffic is expected, it is best to discuss it in advance before the service launch.