Toss authentication

Toss authentication is a service that safely verifies real name, date of birth, mobile phone number, and more based on the information entered by the user (or the information stored in the Toss app), and verifies identity through Toss app authentication. For services that require user identification, such as login, sign-up, and inquiry, you can securely obtain identifiers including CI (Connection Information).

I’m confused about 'Toss Authentication' and 'Toss Login.'

App in Toss provides partner companies with the 'identity verification' feature of Toss Authentication. 'Identity verification' is a service that verifies a user's identity by validating their name, date of birth, and mobile phone number. It is used when legal identity verification is required, such as for age verification, real-name verification, and webboard games.

'Toss Login' is a simple authentication method. It allows users to log in easily with the Toss app without entering separate information, and its purpose and contract structure are different from those of 'Toss Authentication.' If you want to integrate Toss Login, please refer to the Toss Login guide document.

There have been cases where some partner companies confused the two services and signed the wrong contract. Before signing, please make sure to check whether the service you are requesting is 'Toss Authentication' or 'Toss Login.'

Webboard games require identity verification

According to relevant laws, webboard games must go through an identity verification process. By integrating Toss Authentication, you can easily complete identity verification (and age verification if needed).

Toss Authentication types

Toss Authentication offers two methods. Both methods ultimately verify users through Toss app authentication, and the biggest difference is whether personal information is entered on the client side.

1) Personal information-based authentication

This method encrypts the name, date of birth, and mobile phone number entered on the client side before sending them.

Recommended for

• When personal information is already being collected on the sign-up or conversion screen
• When you need to immediately verify whether the entered values match the actual registration information

Flow

1. User enters personal information on the screen
2. Encrypt the entered values and send them through Toss Authentication
3. Toss app authentication (push or biometric authentication, etc.)
4. Receive results (CI, name, mobile phone number, authentication time, etc.)

Features

• It is good for validating entered values (format, typos, etc.).
• The input step may cause a somewhat higher user drop-off rate.

2) One-touch authentication

This is a streamlined method that does not require personal information input on the client side and finishes the process with a single authentication by directly calling the Toss app.

One-touch authentication is the same as using the Toss Authentication service, and it works as follows.

• If the device has a Toss Authentication certificate: PIN authentication or device biometric authentication (Face ID, fingerprint authentication, etc.)
• If the device does not have a Toss Authentication certificate: issue a Toss Authentication certificate, then use PIN authentication or device biometric authentication

Recommended for

• When minimizing drop-off or optimizing conversion rate is important
• When a concise login/re-authentication UX is needed within the app

Flow

1. Click the 'Identity Verification' button
2. Call the Toss app and authenticate the user
3. Receive results (CI, authentication time, etc.)

Features

• Because there is no input step, the UX is very simple.
• It is important to design the matching logic with existing accounts (CI, etc.).

---

Operation tips

• Webboard/adult content services: After identity verification, apply the age policy based on service policy (ageGroup -based policy).
• Re-authentication policy: It is safer to define a re-authentication cycle when there has been long-term inactivity or a major information change (such as a name or number change).
• Minimize personal information: Consider one-touch authentication as the default, and combine input-based authentication only when necessary to minimize personal information collection.

---

Sign up

A prior contract is required to use Toss Authentication. The contract may take 7 to 14 business days.

The Toss Authentication contract is handled by the authentication team on the partner authentication site, not in the console. Please refer to the procedure below.

1. Sign up

Partner authentication sitePlease access it and sign up.

2. Business registration

In the 'Business Registration' menu, submit the required documents and then click the 'Register' button. If you submit the documents appropriate for your business type and request review, it will take about 1 to 2 business days.

• General: Business registration certificate, business registry certificate, corporate seal certificate, power of attorney for the representative, copy of the representative's ID
• If the representative is registering directly: business registration certificate, business registry certificate

3. Create contract

In the 'Contract List' or 'Business Registration' menu, click the 'Create Contract' button. After agreeing to the required terms for the authentication service, register the contract information. If you request review, it will take about 1 to 2 business days.

4. Request creation of a service organization

In the 'Service Organization List' menu, register the required service. If you request review, it will take about 1 to 2 business days.

5. Contract completion and key issuance

Once the contract is complete, you can check the client_idand client_secret keys on the partner authentication site. Please apply the issued keys to your development environment.

---

Integrate development

Issuing AccessToken, retrieving user information, etc. Integration methodcan be checked.