> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/guide/en/authentication/contract.md).
# Toss verification
Toss verification is a service that safely checks real names, dates of birth, mobile phone numbers, and more based on the information entered by the user (or stored in the Toss app), and verifies identity through Toss app authentication. For services that require user identification, such as login, sign-up, and lookup, you can reliably secure identifiers including CI (connection information).
I’m confused about 'Toss Authentication' and 'Toss Login.'
App in Toss provides partner companies with the 'identity verification' feature of Toss Authentication. 'Identity verification' is a service that verifies a user's identity by validating their name, date of birth, and mobile phone number. It is used when legal identity verification is required, such as for age verification, real-name verification, and webboard games.
'Toss Login' is a simple authentication method. It allows users to log in easily with the Toss app without entering separate information, and its purpose and contract structure are different from those of 'Toss Authentication.' If you want to integrate Toss Login, please refer to the Toss Login guide document.
There have been cases where some partner companies confused the two services and signed the wrong contract. Before signing, please make sure to check whether the service you are requesting is 'Toss Authentication' or 'Toss Login.'
{% hint style="warning" %}
**Webboard games require identity verification**
According to relevant laws, webboard games must go through an identity verification process. By integrating Toss Authentication, you can easily complete identity verification (and age verification if needed).
{% endhint %}
### Toss Authentication types
Toss Authentication offers two methods. Both methods ultimately verify users through Toss app authentication, and the biggest difference is whether personal information is entered on the client side.
#### 1) Personal information-based authentication
This method encrypts the name, date of birth, and mobile phone number entered on the client side before sending them.
**Recommended for**
* When personal information is already being collected on the sign-up or conversion screen
* When you need to immediately verify whether the entered values match the actual registration information
**Flow**
1. User enters personal information on the screen
2. Encrypt the entered values and send them through Toss Authentication
3. Toss app authentication (push or biometric authentication, etc.)
4. Receive results (CI, name, mobile phone number, authentication time, etc.)
**Features**
* It is good for validating entered values (format, typos, etc.).
* The input step may cause a somewhat higher user drop-off rate.
#### 2) One-touch authentication
This is a streamlined method that does not require personal information input on the client side and finishes the process with a single authentication by directly calling the Toss app.
One-touch authentication is the same as using the Toss Authentication service, and it works as follows.
* If the device has a Toss Authentication certificate: PIN authentication or device biometric authentication (Face ID, fingerprint authentication, etc.)
* If the device does not have a Toss Authentication certificate: issue a Toss Authentication certificate, then use PIN authentication or device biometric authentication
**Recommended for**
* When minimizing drop-off or optimizing conversion rate is important
* When a concise login/re-authentication UX is needed within the app
**Flow**
1. Click the 'Identity Verification' button
2. Call the Toss app and authenticate the user
3. Receive results (CI, authentication time, etc.)
**Features**
* Because there is no input step, the UX is very simple.
* It is important to design the matching logic with existing accounts (CI, etc.).
***
### Operation tips
* Webboard/adult content services: After identity verification, apply the age policy based on service policy (`ageGroup` -based policy).
* Re-authentication policy: It is safer to define a re-authentication cycle when there has been long-term inactivity or a major information change (such as a name or number change).
* Minimize personal information: Consider one-touch authentication as the default, and combine input-based authentication only when necessary to minimize personal information collection.
***
### Sign up
A prior contract is required to use Toss Authentication. The contract may take 7 to 14 business days.
The Toss Authentication contract is handled by the authentication team on the partner authentication site, not in the console. Please refer to the procedure below.
#### 1. Sign up
[Partner authentication site](https://partner-auth.toss.im/login)Please access it and sign up.
#### 2. Business registration
In the 'Business Registration' menu, submit the required documents and then click the 'Register' button. If you submit the documents appropriate for your business type and request review, it will take about 1 to 2 business days.
* General: Business registration certificate, business registry certificate, corporate seal certificate, power of attorney for the representative, copy of the representative's ID
* If the representative is registering directly: business registration certificate, business registry certificate
#### 3. Create contract
In the 'Contract List' or 'Business Registration' menu, click the 'Create Contract' button. After agreeing to the required terms for the authentication service, register the contract information. If you request review, it will take about 1 to 2 business days.
#### 4. Request creation of a service organization
In the 'Service Organization List' menu, register the required service. If you request review, it will take about 1 to 2 business days.
#### 5. Contract completion and key issuance
Once the contract is complete, you can check the `client_id`and `client_secret` keys on the partner authentication site. Please apply the issued keys to your development environment.
***
### Integrate development
Issuing AccessToken, retrieving user information, etc. [Integration method](https://developers-apps-in-toss.toss.im/documentation/common/authentication/toss-auth#id-2)can be checked.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://developers-apps-in-toss.toss.im/guide/en/authentication/contract.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.