> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-zh/api/auth.md).

# 认证

介绍迷你应用合作伙伴服务器 API 的认证方式。

所有 API 都通过 mTLS（双向 TLS）客户端证书来识别调用主体（迷你应用）。

mTLS 认证在 TLS 连接建立阶段进行，因此不会出现在请求头中。像各 API 文档中的代码示例（cURL·Python·Node.js）那样，需要在请求中同时配置已签发的证书和私钥文件。

防火墙 IP 白名单、mTLS 证书签发·管理、请求限额等运维信息 [使用服务器 API](/documentation/api-and-sdk-zh/integration/server-api.md) 文档。

用户级 API 需要根据端点一并传入以下值之一。

* `x-toss-user-key` 请求头 — 通过 Toss 登录签发的用户密钥（[可通过](/documentation/api-and-sdk-zh/common/authentication/toss-login.md#id-4) 通过 API 获取）
* `x-anon-key` 请求头 — 未登录用户识别密钥（迷你应用 SDK [User.getAnonymousKey](/documentation/api-and-sdk-zh/common/authentication/hash-key.md) 通过函数签发）
* `Authorization: Bearer {accessToken}` 请求头 — Toss 登录 Access Token（[获取 AccessToken](https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-zh/api/pages/edc59f8662b29b00ccf2533fcec84abc6db74af3#id-2.-accesstoken) 通过 API 签发，部分登录 API）


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developers-apps-in-toss.toss.im/documentation/api-and-sdk-zh/api/auth.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.