Toss Login

Connect Toss members all at once in Apps in Toss. With a single consent, it continues through sign-up, login, and information sharing, so you can easily implement Toss member integration.

Benefits of Toss Login

• Users can sign up and log in right away without a separate sign-up form, creating a smooth registration experience.
• You can use reliable user information provided directly by Toss.
• Returning users can use automatic login or one-click login.
• Even if the app is reinstalled or the device is changed, users are matched as the same user, reducing the burden of handling customer inquiries.

Please be sure to check

• In Mini Apps, only Toss Login can be used as the login feature. Your own login or other easy-login methods cannot be used.
• To use functional push notifications, alerts, promotions, and Toss Pay, you must integrate Toss Login.

---

Set up in the console

1. Agree to the terms

To use Toss Login, you must first agree to the terms. You can do so in the Apps in Toss console, and only from the account of the person designated as the primary admin.

2. Set up

To integrate login, you need to finish the pre-setup in the console. The user terms consent screen is automatically configured based on the information you entered.

Service to integrate

This area is shown if there is already a service using Toss Login. The member identifier of the existing service (userKey) can be set to match Apps in Toss Toss Login exactly. If you select a service name from the list, the selected service's userKey value is mapped identically.

However, userKeyis a value that is unique only within that app. Even for the same user, if the app is different, userKeymay be different.

Consent items

To collect with Toss Login user permissions (scope)Please select the items you want. If you select items other than name, email, and gender, disconnect callback informationmust be entered.

Item	Description
Name (USER_NAME)	This is the user's name.
Email (USER_EMAIL)	This is the user's email. (It is not required when signing up for Toss, so it may be missing, and in that case nullis passed as null.)
Gender (USER_GENDER)	This is the user's gender.
Birthday (USER_BIRTHDAY)	This is the user's date of birth.
Nationality (USER_NATIONALITY)	This is the user's nationality.
Phone number (USER_PHONE)	This is the user's phone number.
CI (USER_CI)	It is a unique KEY used to identify the user. (Connection Information)

Toss does not always receive an email address, so there may be users with no email value (null).

Please make sure the app works properly even when the value is missing.

What is CI?

CI (Connection Information) is issued by an identity verification agency unique identifier . Even if the same user signs up for multiple services an immutable value created so they can be identified as the same person . CI is used in services that require real-name verification to prevent duplicate sign-ups or identify the user and is often used for that purpose.

Under the Personal Information Protection Act, CI is considered personally identifiable information (PII). When storing or using it, you must encrypt itand, the principle of minimum collectionmust be followed.

Terms/Consent texts

To operate a service in Apps in Toss, you need to register the terms. Required Toss Login terms(Service terms, consent to provide personal information to third parties) are automatically included. Partner service terms, consent to collect and use personal information, consent to receive marketing information (optional) must be registered manually. Please attach the exact terms linkto it.

You can choose the terms type from the provided examples or enter it manually. If you want to manage the terms separately, we recommend entering them manually.

If you store or transfer personal information received through Toss Login to an overseas cloud region or a server operated by an overseas provider, consent form for cross-border transfer of personal informationmust be registered. The consent form must include the recipient, the country to which the data is transferred, the recipient's contact information, the items transferred, the timing and method of transfer, the purpose of use, and the retention and use period.

Please make sure all terms links are connected correctly and displayed clearly on the screen.

Please note

This section is an area that must meet legal requirements . Since the content may vary depending on the nature of the service, checking the latest laws and guidelines and getting legal adviceis recommended.

Terms items you can register

• Terms of Service — rights and obligations, scope of liability, suspension/termination, dispute resolution, notice of terms changes, and (if paid) payment/refund policies
• Consent to collect and use personal information — items collected, purpose of use, retention/use period, disadvantages if consent is refused
• Consent to receive marketing information (optional) — items collected, purpose of use, retention period, disadvantages if refused, consent to receive ads via electronic transmission media
• Consent to receive nighttime benefits (optional) — specify whether messages are sent at night (21:00~08:00)
• Consent to cross-border transfer of personal information (if applicable) — if personal information is transferred overseas, specify the recipient, destination country, recipient contact information, timing and method of transfer, transfer items, purpose of use, and retention/use period

disconnect callback information

If a user disconnects login in the Toss app, you can receive an event at the registered callback URL.

When the user disconnects, Toss deletes all consent terms and login information . Please also make sure to perform post-processing in your service, such as clearing sessions or tokens.

Also, if the user disconnects login in the Toss app, in your service you should also handle automatic logoutor guide them to log in again . We recommend providing this. For example, it is good to show a message like "Your Toss connection has been disconnected, so you need to log in again."

Item	Description
Callback URL	This is the URL to call when the user disconnects login.
HTTP method	GET or POST Please choose one.
Basic Auth header	It is encoded in base64 when called. After decoding it, verify that it matches the value entered in the console.

Disconnect event path

There are a total of 3 waysfor a user to disconnect login in the Toss app. When making a callback request, referrer you can distinguish them by value.

referrer	Description
UNLINK	When the user disconnects directly in the app it is called. In Mini Apps, when you receive this event, log the user outplease do so. (Path: Toss app > Settings > Authentication and Security > Services logged in with Toss > 'Disconnect')
WITHDRAWAL_TERMS	When the user when withdrawing consent for the login service terms it is called. (Path: Toss app > Settings > Legal Information and Others > Terms and Consent to Process Personal Information > Service-specific consent details: "Toss Login" > 'Withdraw consent')
WITHDRAWAL_TOSS	When the user when withdrawing as a Toss member it is called.

---

Receive decryption key by email

Once Toss Login information registration is complete, you can check the decryption key. This key is used to decrypt Toss Login response data. Click the 'Receive decryption key by email' button to receive it securely.

The decryption key is sensitive security information.

• Never expose it externally.
• Please store it in a secure internal secret store (such as Secret Manager).
• If you need it reissued, please contact Channel Talk.

---

Integrate development

Authorization code issuance (SDK), AccessToken issuance, retrieving user information, etc. Integration methodcan be checked.

---

Integrate Toss Login into your own web/app

To apply Toss Login to your own web/app, a separate contract with Toss's authentication team is required. However, if you are a partner company using Toss Login in Apps in Toss, you can use it without a separate contract.

1. Apply for Toss Login in the Apps in Toss console

After checking the guide above, please first apply for Toss Login in the Apps in Toss console.

2. Fill in the required information and request a Client ID

Fill out all of the items below and email the Toss authentication team ([e-mail]) at this email address.

Item	Description	example
Web/App	Please describe the service type you want to apply it to (web, app, or both)	Web, app
Member identification key	Please enter the key to use for user identification	CI, email
Required personal information items	Please write the personal information items you want to receive (refer to Apps in Toss console > Toss Login > Consent items)	Name, email address
Terms list	Please enter the title, URL, and whether each term is required	Terms of Use (required) - https://example.com/terms
redirect_uri	Please enter the URL to redirect to after login is complete	https://example.com/callback
Planned app version for integration	If you are also introducing it to a partner app, please enter the app version	iOS 3.2.0, Android 2.8.1
Whether to use the login disconnect API	Please specify whether you will use this API (if left blank, it will be set to 'Not used')	Not used
Network information	If you use a VPN or need development environment integration, separate registration is required. Please enter the server's IP or IP range	123.45.67.89