> For the complete documentation index, see [llms.txt](https://developers-apps-in-toss.toss.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers-apps-in-toss.toss.im/guide/en/authentication/intro.md).

# Toss Login

Link Toss members all at once in Apps in Toss. With one consent, the flow continues from sign-up to login and information provision, making it easy to implement Toss member integration.

### Benefits of Toss Login

* Users can sign up and log in right away without a separate sign-up form, creating a smooth registration experience.
* You can use reliable user information provided directly by Toss.
* Returning users can use automatic login or one-click login.
* Even if the app is reinstalled or the device is changed, users are matched as the same user, reducing the burden of handling customer inquiries.

{% hint style="info" %}
**Please be sure to check**

* In Mini Apps, only Toss Login can be used as the login feature. Your own login or other easy-login methods cannot be used.
* To use functional push notifications, alerts, promotions, and Toss Pay, you must integrate Toss Login.
  {% endhint %}

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2FLvK8oLVnZMo83WkfM4X2%2Fimage.png?alt=media&#x26;token=d25c4cad-d817-4992-8eaa-95b26aa11059" alt=""><figcaption></figcaption></figure>

***

### Set up in the console

#### 1. Agree to the terms

To use Toss Login, you must first agree to the terms. You can do so in the Apps in Toss console, and only from the account of the person designated as the primary admin.

#### 2. Set up

To integrate login, you need to finish the pre-setup in the console. The user terms consent screen is automatically configured based on the information you entered.

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2F7wKRUxTjtvQLTMMaZrKl%2F%E1%84%8B%E1%85%AF%E1%86%AB%E1%84%87%E1%85%A9%E1%86%AB%2084%20(1).png?alt=media&#x26;token=e6b95b66-7b03-4f99-9c40-60b6a94ae6bc" alt=""><figcaption></figcaption></figure>

**Service to integrate**

This area is shown if there is already a service using Toss Login. The member identifier of the existing service (`userKey`) can be set to match Apps in Toss Toss Login exactly. If you select a service name from the list, the selected service's `userKey` value is mapped identically.

However, `userKey`is a value that is unique only within that app. Even for the same user, if the app is different, `userKey`may be different.

**Consent items**

To collect with Toss Login **user permissions (scope)**&#x50;lease select the items you want. If you select items other than name, email, and gender, **disconnect callback information**must be entered.

<table data-search="false"><thead><tr><th>Item</th><th>Description</th></tr></thead><tbody><tr><td>Name (USER_NAME)</td><td>This is the user's name.</td></tr><tr><td>Email (USER_EMAIL)</td><td>This is the user's email. (It is not required when signing up for Toss, so it may be missing, and in that case <code>null</code>is passed as null.)</td></tr><tr><td>Gender (USER_GENDER)</td><td>This is the user's gender.</td></tr><tr><td>Birthday (USER_BIRTHDAY)</td><td>This is the user's date of birth.</td></tr><tr><td>Nationality (USER_NATIONALITY)</td><td>This is the user's nationality.</td></tr><tr><td>Phone number (USER_PHONE)</td><td>This is the user's phone number.</td></tr><tr><td>CI (USER_CI)</td><td>It is a unique KEY used to identify the user. (Connection Information)</td></tr></tbody></table>

{% hint style="warning" %}
Toss does not always receive an email address, so there may be users with no email value (null).

Please make sure the app works properly even when the value is missing.
{% endhint %}

<details>

<summary>What is CI?</summary>

CI (Connection Information) is issued by an identity verification agency **unique identifier** . Even if the same user signs up for multiple services **an immutable value created so they can be identified as the same person** . CI is used in services that require real-name verification **to prevent duplicate sign-ups or identify the user** and is often used for that purpose.

Under the Personal Information Protection Act, CI is considered personally identifiable information (PII). When storing or using it, you must **encrypt it**and, **the principle of minimum collection**must be followed.

</details>

**Terms/Consent texts**

To operate a service in Apps in Toss, you need to register the terms. **Required Toss Login terms**(Service terms, consent to provide personal information to third parties) are automatically included. **Partner service terms, consent to collect and use personal information, consent to receive marketing information (optional)** must be registered manually. Please attach the **exact terms link**to it.

You can choose the terms type from the provided examples or enter it manually. If you want to manage the terms separately, we recommend entering them manually.

If you store or transfer personal information received through Toss Login to an overseas cloud region or a server operated by an overseas provider, **consent form for cross-border transfer of personal information**must be registered. The consent form must include the recipient, the country to which the data is transferred, the recipient's contact information, the items transferred, the timing and method of transfer, the purpose of use, and the retention and use period.

<figure><img src="https://941686070-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2Fs5JiMXMSTiQpALYwUzsF%2Fimage.png?alt=media&amp;token=0152c68e-0655-419f-af6e-00b18c2d929f" alt=""><figcaption></figcaption></figure>

Please make sure all terms links are connected correctly and displayed clearly on the screen.

{% hint style="warning" %}
**Please note**

This section **is an area that must meet legal requirements** . Since the content may vary depending on the nature of the service, **checking the latest laws and guidelines and getting legal advice**is recommended.
{% endhint %}

<details>

<summary>Terms items you can register</summary>

* **Terms of Service** — rights and obligations, scope of liability, suspension/termination, dispute resolution, notice of terms changes, and (if paid) payment/refund policies
* **Consent to collect and use personal information** — items collected, purpose of use, retention/use period, disadvantages if consent is refused
* **Consent to receive marketing information (optional)** — items collected, purpose of use, retention period, disadvantages if refused, consent to receive ads via electronic transmission media
* **Consent to receive nighttime benefits (optional)** — specify whether messages are sent at night (21:00\~08:00)
* **Consent to cross-border transfer of personal information (if applicable)** — if personal information is transferred overseas, specify the recipient, destination country, recipient contact information, timing and method of transfer, transfer items, purpose of use, and retention/use period

</details>

**disconnect callback information**

If a user disconnects login in the Toss app, you can receive an event at the registered callback URL.

When the user disconnects, Toss **deletes all consent terms and login information** . Please also make sure to perform post-processing in your service, such as clearing sessions or tokens.

Also, if the user disconnects login in the Toss app, in your service you should also **handle automatic logout**or **guide them to log in again** . We recommend providing this. For example, it is good to show a message like "Your Toss connection has been disconnected, so you need to log in again."

| Item              | Description                                                                                                      |
| ----------------- | ---------------------------------------------------------------------------------------------------------------- |
| Callback URL      | This is the URL to call when the user disconnects login.                                                         |
| HTTP method       | `GET` or `POST` Please choose one.                                                                               |
| Basic Auth header | It is encoded in base64 when called. After decoding it, verify that it matches the value entered in the console. |

**Disconnect event path**

There are a total of **3 ways**for a user to disconnect login in the Toss app. When making a callback request, `referrer` you can distinguish them by value.

| referrer           | Description                                                                                                                                                                                                                                                               |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `UNLINK`           | When the user **disconnects directly in the app** it is called. In Mini Apps, when you receive this event, **log the user out**please do so. (Path: Toss app > Settings > Authentication and Security > Services logged in with Toss > 'Disconnect')                      |
| `WITHDRAWAL_TERMS` | When the user **when withdrawing consent for the login service terms** it is called. (Path: Toss app > Settings > Legal Information and Others > Terms and Consent to Process Personal Information > Service-specific consent details: "Toss Login" > 'Withdraw consent') |
| `WITHDRAWAL_TOSS`  | When the user **when withdrawing as a Toss member** it is called.                                                                                                                                                                                                         |

***

### Receive decryption key by email

Once Toss Login information registration is complete, you can check the decryption key. This key is used to decrypt Toss Login response data. Click the 'Receive decryption key by email' button to receive it securely.

{% hint style="warning" %}
**The decryption key is sensitive security information.**

* Never expose it externally.
* Please store it in a secure internal secret store (such as Secret Manager).
* If you need it reissued, please contact Channel Talk.
  {% endhint %}

<figure><img src="https://3177177630-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8pQgXiR5QAzduV54W8Om%2Fuploads%2FRLbRu8k6r3e7sKyJyRpv%2F%E1%84%80%E1%85%A9%E1%86%BC%E1%84%8C%E1%85%B5%E1%84%89%E1%85%A1%E1%84%92%E1%85%A1%E1%86%BC%2010.png?alt=media&#x26;token=de4bead1-da2b-4f05-a594-bcf3c901e24b" alt=""><figcaption></figcaption></figure>

***

### Integrate development

Authorization code issuance (SDK), AccessToken issuance, retrieving user information, etc. [Integration method](https://developers-apps-in-toss.toss.im/documentation/common/authentication/toss-login#undefined)can be checked.

***

### Integrate Toss Login into your own web/app

To apply Toss Login to your own web/app, a separate contract with Toss's authentication team is required. However, if you are a partner company using Toss Login in Apps in Toss, you can use it without a separate contract.

#### 1. Apply for Toss Login in the Apps in Toss console

After checking the guide above, please first apply for Toss Login in the Apps in Toss console.

#### 2. Fill in the required information and request a Client ID

Fill out all of the items below and email the Toss authentication team (<cert.support@toss.im>) at this email address.

<table data-search="false"><thead><tr><th>Item</th><th>Description</th><th>example</th></tr></thead><tbody><tr><td>Web/App</td><td>Please describe the service type you want to apply it to (web, app, or both)</td><td>Web, app</td></tr><tr><td>Member identification key</td><td>Please enter the key to use for user identification</td><td>CI, email</td></tr><tr><td>Required personal information items</td><td>Please write the personal information items you want to receive (refer to Apps in Toss console > Toss Login > Consent items)</td><td>Name, email address</td></tr><tr><td>Terms list</td><td>Please enter the title, URL, and whether each term is required</td><td>Terms of Use (required) - https://example.com/terms</td></tr><tr><td>redirect_uri</td><td>Please enter the URL to redirect to after login is complete</td><td>https://example.com/callback</td></tr><tr><td>Planned app version for integration</td><td>If you are also introducing it to a partner app, please enter the app version</td><td>iOS 3.2.0, Android 2.8.1</td></tr><tr><td>Whether to use the login disconnect API</td><td>Please specify whether you will use this API (if left blank, it will be set to 'Not used')</td><td>Not used</td></tr><tr><td>Network information</td><td>If you use a VPN or need development environment integration, separate registration is required. Please enter the server's IP or IP range</td><td>123.45.67.89</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developers-apps-in-toss.toss.im/guide/en/authentication/intro.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.