> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/guide/en/authentication/contract.md).
# Toss Verification
I'm confused about 'Toss Authentication' and 'Toss Login.'
App in Toss provides partner companies with the 'identity verification' feature of Toss Authentication. 'Identity verification' is a service that verifies a user's identity by checking their name, date of birth, and mobile phone number. It is used when legal identity verification is required, such as for age verification, real-name verification, or web board games.
'Toss Login' is a simple authentication method. It is a feature that lets users log in easily through the Toss app without entering separate information, and its purpose and contract structure are different from Toss Authentication. If you want to integrate Toss Login, please refer to the Toss Login guide document.
There have been cases where some partner companies confused the two services and signed the wrong contract. Before signing a contract, please be sure to check whether the service you are requesting is 'Toss Authentication' or 'Toss Login.'
{% hint style="warning" %}
**Identity verification is required for web board games**
According to relevant laws, web board games must go through identity verification. By integrating Toss Authentication, you can easily complete identity verification, and if needed, even adult verification.
{% endhint %}
### Toss Authentication types
Toss Authentication provides two methods. Both methods ultimately verify users through Toss app authentication, and the biggest difference is whether personal information is entered on the client side.
#### 1) Personal information-based authentication
This method encrypts and sends the user's name, date of birth, and mobile phone number entered on the client side.
**Recommended when**
* You are already collecting personal information on the sign-up or conversion screen
* You need to immediately verify whether the entered information matches the actual sign-up information
**Flow**
1. The user enters personal information on the screen
2. The entered information is encrypted and sent to Toss Authentication
3. Toss app authentication (push or biometric authentication, etc.)
4. Result received (CI, name, mobile phone number, authentication time, etc.)
**Features**
* It is advantageous for validating entered values (format, typos, etc.).
* Because there is an input process, user drop-off may be somewhat higher.
#### 2) One-touch authentication
This is a simplified method that does not receive personal information on the client side, but instead immediately opens the Toss app and completes the process with a single authentication.
One-touch authentication is the same as using the Toss Authentication service, and it works like this.
* If there is a Toss certificate on the device: PIN authentication or device biometric authentication (Face ID, fingerprint authentication, etc.)
* If there is no Toss certificate on the device: Issue a Toss certificate, then PIN authentication or device biometric authentication
**Recommended when**
* When minimizing drop-off or optimizing conversion rate is important
* When a concise login or re-authentication UX is needed within the app
**Flow**
1. Click the 'Identity Verification' button
2. Open the Toss app and authenticate the user
3. Result received (CI, authentication time, etc.)
**Features**
* Because there is no input step, the UX is very simple.
* It is important to design the matching logic with existing accounts (CI, etc.).
***
### Operational tips
* Web board and adult content services: After identity verification, according to the service policy, determine adult status (`ageGroup` based policy).
* Re-authentication policy: It is safer to define a re-authentication cycle when there is long-term inactivity or major information changes (such as name or number changes).
* Minimize personal information: Consider one-touch authentication as the default, and combine input-based authentication only when necessary to minimize the collection of personal information.
***
### Sign up for a contract
To use Toss Authentication, a prior contract is required. The contract process may take 7 to 14 business days.
The Toss Authentication contract is handled by the authentication team on the partner authentication site, not in the console. Please refer to the steps below.
#### 1. Sign up
[Partner Authentication Site](https://partner-auth.toss.im/login)Please visit and sign up.
#### 2. Business registration
In the 'Business Registration' menu, submit the required documents and then click the 'Register' button. Submit the documents appropriate for your business type and request a review; it will take about 1 to 2 business days.
* General: Business registration certificate, corporate registration certificate, corporate seal certificate, power of attorney, and a copy of the representative's ID
* If the representative registers in person: Business registration certificate, corporate registration certificate
#### 3. Create contract
In the 'Contract List' or 'Business Registration' menu, click the 'Create Contract' button. After agreeing to the required terms for the authentication service, register the contract information. After requesting a review, it will take about 1 to 2 business days.
#### 4. Request creation of an institution
In the 'Institution List' menu, register the required services. After requesting a review, it will take about 1 to 2 business days.
#### 5. Contract completion and key issuance
Once the contract is complete, you can check the `client_id`and `client_secret` keys on the partner authentication site. Please apply the issued keys to your development environment.
***
### Integrate development
Issuing an AccessToken, retrieving user information, etc. [Integration method](https://developers-apps-in-toss.toss.im/documentation/common/authentication/toss-auth#id-2)can be checked.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://developers-apps-in-toss.toss.im/guide/en/authentication/contract.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.