> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/guide/en/authentication/intro.md).

# Toss Login

### Benefits of Toss Login

* You can sign up and log in immediately without a separate sign-up form, creating a smooth registration experience.
* You can use highly reliable user information provided directly by Toss.
* When users revisit, they can use automatic login or one-click login.
* Even if users reinstall the app or change devices, they’re matched as the same user, reducing the burden of customer support inquiries.

{% hint style="info" %}
**Please be sure to check**

* In Mini Apps, you can only use Toss Login as the login function. You can’t use your own login or other simple login methods.
* To use functional push notifications, alerts, promotions, and Toss Pay, you must integrate Toss Login.
  {% endhint %}

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2FLvK8oLVnZMo83WkfM4X2%2Fimage.png?alt=media&#x26;token=d25c4cad-d817-4992-8eaa-95b26aa11059" alt=""><figcaption></figcaption></figure>

***

### Set it up in the console

#### 1. Agree to the terms

To use Toss Login, you must first agree to the terms. You can do this in the App in Toss console, and only from the account designated as the primary administrator.

#### 2. Set up

To integrate login, you need to complete the pre-setup in the console. Based on the information you enter, the user terms consent screen is automatically configured.

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2F7wKRUxTjtvQLTMMaZrKl%2F%E1%84%8B%E1%85%AF%E1%86%AB%E1%84%87%E1%85%A9%E1%86%AB%2084%20(1).png?alt=media&#x26;token=e6b95b66-7b03-4f99-9c40-60b6a94ae6bc" alt=""><figcaption></figcaption></figure>

**Service to integrate**

This area is shown if you already have a service using Toss Login. You can set the member identifier of the existing service (`userKey`) to be the same as App in Toss Login. When you select a service name from the list, the selected service's `userKey` value is mapped identically.

However, `userKey`is a value that is unique only within that app. `userKey`Even for the same user, userKey may differ if the app is different.

**Consent items**

User permissions (scopes) to collect with Toss Login **choose.**&#x49;f you select items other than name, email, and gender, **disconnect callback information**must be entered.

<table data-search="false"><thead><tr><th>Item</th><th>Description</th></tr></thead><tbody><tr><td>Name (USER_NAME)</td><td>This is the user's name.</td></tr><tr><td>Email (USER_EMAIL)</td><td>This is the user's email address. (It is not required when signing up for Toss, so it may not exist, and in that case <code>null</code>is passed.)</td></tr><tr><td>Gender (USER_GENDER)</td><td>This is the user's gender.</td></tr><tr><td>Birthday (USER_BIRTHDAY)</td><td>This is the user's date of birth.</td></tr><tr><td>Nationality (USER_NATIONALITY)</td><td>This is the user's nationality.</td></tr><tr><td>Phone number (USER_PHONE)</td><td>This is the user's phone number.</td></tr><tr><td>CI (USER_CI)</td><td>This is a unique KEY value used to identify the user. (Connection Information)</td></tr></tbody></table>

{% hint style="warning" %}
Toss does not necessarily receive email addresses, so there may be users without an email value (null).

Please make sure the app works properly even when there is no value.
{% endhint %}

<details>

<summary>What is CI?</summary>

CI (Connection Information) is **a unique identifier**issued by the identity verification agency. **an immutable value created so the same person can be identified even if they sign up for multiple services**CI is used in services that require real-name verification **to prevent duplicate signups and identify the user** for this purpose.

Under the Personal Information Protection Act, CI is considered personally identifiable information (PII). When storing or using it, be sure to **encrypt it**and, **follow the principle of minimum collection**.

</details>

**Terms/consent statements**

To operate a service in App in Toss, you need to register terms. **Mandatory Toss Login terms**(Service Terms, Consent to Third-Party Provision of Personal Information) are automatically included. **Partner service terms, consent to collection and use of personal information, and consent to receive marketing information (optional)** must be registered manually. Please attach an **accurate terms link**.

You can choose the terms type from the built-in examples or enter it manually. If you want to manage terms separately, we recommend entering them manually.

If personal information received via Toss Login is stored or transferred to overseas cloud regions or servers operated by overseas providers, **consent statement for overseas transfer of personal information**must be registered. The consent statement must include the transferee, the country to which the data is transferred, the transferee's contact information, items transferred, the timing and method of transfer, the purpose of use, and the retention/use period.

<figure><img src="/files/3117af51089f485117f37de0136a4576e6c672a5" alt=""><figcaption></figcaption></figure>

Please make sure all terms links are connected correctly and displayed clearly on the screen.

{% hint style="warning" %}
**Please note**

This area **requires meeting legal requirements**. Since the content may vary depending on the nature of the service, **we recommend checking the latest laws and guidelines and getting legal advice**.
{% endhint %}

<details>

<summary>Terms items that can be registered</summary>

* **Terms of Service** — rights and obligations, scope of liability, suspension/termination, dispute resolution, notice of terms changes, (if paid) payment/refund rules
* **Consent to collection and use of personal information** — items collected, purpose of use, retention/use period, disadvantages of refusing consent
* **Consent to receive marketing information (optional)** — collected items, purpose of use, retention period, disadvantages of refusal, consent to receive advertising through electronic transmission media
* **Consent to receive nighttime benefits (optional)** — specify whether messages are sent at night (21:00\~08:00)
* **Consent to overseas transfer of personal information (if applicable)** — if personal information is transferred overseas, specify the transferee, the country to which it is transferred, the transferee's contact information, the timing and method of transfer, items transferred, the purpose of use, and the retention/use period

</details>

**disconnect callback information**

When a user disconnects login in the Toss app, you can receive an event at the registered callback URL.

When the user disconnects, Toss **deletes both the consent terms and login information**. In your service, be sure to perform post-processing such as clearing sessions or tokens.

Also, when a user disconnects login in the Toss app, we recommend that your service **perform automatic logout**or **show a re-login prompt**. For example, it’s good to show a message like "Toss connection has been disconnected, so you need to log in again."

| Item              | Description                                                                                                |
| ----------------- | ---------------------------------------------------------------------------------------------------------- |
| Callback URL      | This is the URL that will be called when the user disconnects login.                                       |
| HTTP method       | `GET` or `POST` Please choose one.                                                                         |
| Basic Auth header | It is base64-encoded when called. After decoding, verify that it matches the value entered in the console. |

**Disconnect event paths**

There are a total of **3**paths for a user to disconnect login in the Toss app. You can distinguish them by the `referrer` value in the callback request.

| referrer           | Description                                                                                                                                                                                                                                         |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `UNLINK`           | Called when the user **disconnects directly from the app** . In Mini Apps, when you receive this event, **log out**. (Path: Toss app > Settings > Authentication and Security > Services logged in with Toss > 'Disconnect')                        |
| `WITHDRAWAL_TERMS` | Called when the user **Called when withdrawing from the login service terms** . (Path: Toss app > Settings > Legal Information and Others > Terms and Privacy Policy Consent > Service-specific consent details: "Toss Login" > 'Withdraw consent') |
| `WITHDRAWAL_TOSS`  | Called when the user **Called when withdrawing from Toss membership** .                                                                                                                                                                             |

***

### Receive the decryption key by email

Once registration of Toss Login information is complete, you can check the decryption key. This key is used to decrypt Toss Login response data. Click the 'Receive the decryption key by email' button to get it securely.

{% hint style="warning" %}
**The decryption key is sensitive security information.**

* Never expose it externally.
* Keep it in a secure internal secret store (such as Secret Manager).
* If you need to issue it again, please contact us via Channel Talk.
  {% endhint %}

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2FRLbRu8k6r3e7sKyJyRpv%2F%E1%84%80%E1%85%A9%E1%86%BC%E1%84%8C%E1%85%B5%E1%84%89%E1%85%A1%E1%84%92%E1%85%A1%E1%86%BC%2010.png?alt=media&#x26;token=de4bead1-da2b-4f05-a594-bcf3c901e24b" alt=""><figcaption></figcaption></figure>

***

### Integrate development

Authorization code issuance (SDK), AccessToken issuance, user info lookup, etc. [Integration method](https://developers-apps-in-toss.toss.im/documentation/common/authentication/toss-login#undefined)can be checked.

***

### Integrate Toss Login into your own web/app

To apply Toss Login to your own web/app, you originally need a separate contract with the Toss authentication team. However, if you are a partner company using Toss Login in App in Toss, you can use it without a separate contract.

#### 1. Apply for Toss Login in the App in Toss console

After reviewing the guide above, first apply for Toss Login in the App in Toss console.

#### 2. Fill in the required information and request Client ID issuance

Please fill out all the items below and send an email to the Toss authentication team (<cert.support@toss.im>).

<table data-search="false"><thead><tr><th>Item</th><th>Description</th><th>example</th></tr></thead><tbody><tr><td>Web/app type</td><td>Please enter the type of service you want to apply to (web, app, or both)</td><td>Web, app</td></tr><tr><td>Member identifier key</td><td>Please enter the key to be used for user identification</td><td>CI, email</td></tr><tr><td>Required personal information items</td><td>Please enter the personal information items you want to receive (refer to App in Toss Console > Toss Login > Consent items)</td><td>Name, email address</td></tr><tr><td>Terms list</td><td>Please enter the title, URL, and whether each term is required</td><td>Terms of Use (Required) - https://example.com/terms</td></tr><tr><td>redirect_uri</td><td>Please enter the URL to move to after login is completed</td><td>https://example.com/callback</td></tr><tr><td>Planned app version</td><td>If you are also introducing it into a partner app, please enter the app version</td><td>iOS 3.2.0, Android 2.8.1</td></tr><tr><td>Whether to use the login disconnect API</td><td>Please indicate whether you will use this API (if left blank, it will be set to 'Not used')</td><td>Not used</td></tr><tr><td>Network information</td><td>If you use a VPN or need development environment integration, separate registration is required. Please enter the server IP or IP range.</td><td>123.45.67.89</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developers-apps-in-toss.toss.im/guide/en/authentication/intro.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.