Security Guidelines

1. Security settings in Kakao Developers

1.1. Set platform

Kakao platform only allows the apps with the registered Android package, iOS bundle, or the website domain information to access the Kakao SDK (Software Development Kit). Thus, you must register your app information in [My Application] > [Platform].

• Android SDK: Add key hashes.
• iOS SDK: Set Bundle ID.
• JavaScript SDK: Set website domain. To send a Kakao Talk sharing message, the shared URL also must be registered as a website domain. Otherwise, Kakao Talk fails to open the URL.

1.2. Set Redirect URI

To protect from attacks such as malicious redirects to other sites, Kakao passes an authorization code to the registered redirect URI only. For this, you must register a redirect URI in [My Application] > [Kakao Login], and pass the registered redirect URI for the value of redirect_uri. Only when the value of redirect_uri in the request matches the registered redirect URI, the authorization code is issued from the Kakao authorization server.

1.3. Use client secret code

To enhance security when issuing an access token, you can use a client secret code for additional verification. Go to [My Application] > [Security], and then generate a client secret code. Then, pass the generated code through the client_secret parameter when calling the Getting tokens or Refreshing tokens API. Note that you must use the client secret code in server-side (backend) only and keep it secret not to be revealed on user browser.

1.4. Set Allowed IP address

To allows only the API requests sent from the predefined IP addresses, you can set IP addresses in [My Application] > [Allowed IP address].

1.5. Manage team members

To allow only the person registered as a team member to change the app settings, you can add a developer's account as a team member of your app in [My Application] > [Team Management] by clicking [Invite team member]. Since the Owner account has all permissions for the app, you must use a strong password for the Owner account not to leak the account information.

You can grant different permission to each team member depending on the usage purpose. If you need to create a test app and test the implemented functions before the app release, you can enhance the security since the test app is only available for the registered team members.

If the person with the Owner account has left the company, change the app owner, and then remove the team members from the app by clicking [Expel] on the Team Management page.

2. Secure API calls

2.1. Keep app keys safe

The app keys are issued for each platform when you create an app. The Kakao Platform verifies the API requests with the passed app key. In the case of the Admin key, you must use it only in the server-side (backend) not to be leaked since the admin key has all permissions.

If app keys are leaked, you can reissue the app keys with the Owner account of the app. Note that you cannot undo reissuing app keys and cannot use the old app keys.

2.2. Keep access token safe

Since an access token is used to make API calls, you must keep the access token secret not to be revealed. You also must use the refresh token on the server-side (backend) only.

We recommend using the allowed IP address function to prevent others from calling an API with the stolen access token just in case the access token is revealed.

2.3. Use state parameter

To prevent Cross-Site Request Forgery (CSRF) attacks, you can use the state parameter when calling the Getting authorization code API. The state value is used to verify the source of the request for the authorization code by passing the state value to the redirect URI.

Pass a unique and random value for each login request through state when a user requests to log in with Kakao. Then, check if the value matches the value passed to the redirect URI.

You must store the state value somewhere that other third parties cannot access, such as sessions or cookies that are protected under identical resource policies. For more information, refer to RFC 6749 10.12.

2.4. Use prompt parameter

To enhance security, you can request for login regardless of whether the user is authenticated by presenting the Kakao Account Login screen. For this, use the prompt parameter which is optional. Set prompt to login when requesting authorization code.

2.5. Use nonce parameter

If you get an ID token through OpenID Connect, you can use the nonce parameter when calling the Getting authorization code API to protect from ID token replay attacks. Pass a unique and random value through nonce, which is used to be compared and verified when verifying ID token.

2.6. Allow firewall exceptions for API calls

If your service only allows system calls approved through firewalls, add IP addresses of the Kakao API host used to call Kakao APIs, such as kauth.kakao.com and kapi.kakao.com.

If you use callback functions such as Unlink callback, Kakao Talk Channel callback, and Kakao Talk sharing success callback, allow IP addresses used by Kakao to send callbacks.

If you want to configure a preview page of your service before sending a Kakao Talk sharing message, add IP addresses used for scrapping request to allow your service to access the Kakao scrapping server.

3. Security settings in system setup

3.1. Encrypt data in transmission

To protect all sensitive data transmitted to or from the application layer, you must comply with the followings:

• Use HTTPS.
• Use a trusted certificate authority (CA).
• Use the latest version of Transport Layer Security (TLS) if possible. Refer to TLS versions supported by Kakao API server.

For the redirect URI used to get an authorization code and tokens, you must use HTTPS unless there is a special reason. Refer to RFC 6749 3.1.2.1

3.2. Encrypt data when storing data

You must encrypt all sensitive data stored as a file or database.

3.3. Prohibit logging of sensitive data

You must not save the user's information received from Kakao in the system log.

3.4. Cautions when mapping existing members logged in with Kakao

If a user signs up through the signup process of your service, and the user is identical to one of Kakao Login users, you are required to map the user onto the existing user data by complying with the followings:

• After users sign up for your service through Kakao Login, you must identify the users by using their service user IDs that are obtained through the Retriving user information API (/v2/user/me).
• A service user ID is a length-variable number between 1 and 9,223,372,036,854,775,807 with a Long type. You must implement a mapping functionality by considering that the number length may vary in the range.
• You can identify users by using Connecting Information (CI) or email. If you use email for user identification, you must map users only after the user verification is completed. If using a phone number, you must not simply compare strings because the owner of a phone number may change.
• It is highly recommended to implement a process that asks a user to log in with the existing account before mapping onto the existing data to ensure that the user is the owner of the account.

3.5. Cautions when implementing functions

To protect users' personal information and to securely use the functions provided by Kakao Developers, you must comply with the Operating Policy.

• In accordance with Article 1 (Obligation of Service Users), Paragraph 2 of the Operating Policy, you must provide a menu to delete an account from your service. When a user deletes their account, delete the user's personal information in an irrecoverable way. The service user IDs that are obtained through the Retrieving user information API (/v2/user/me) are also personal information that needs to be destroyed.
• If you need to keep service user IDs for a certain period, you must leave the basis for storage in terms of service or privacy policy and obtain the separate user's consent.
• When a user deletes an account, you must request the Unlink API to withdraw the user's consent for the provision of personal information.
• To synchronize the withdrawal of consent for the provision of personal information and the deletion of personal information in the service, it is recommended to delete an account from the service by receiving the unlink callback from Kakao when the unlink occurs in the Use Your Account menu of the Kakao Account Management page.

3.6. Security Event Subscription

To keep users' personal information up to date, use Security Event Subscription providing users' security status changes.

• You can receive event information in JWT(JSON Web Token) format if you enable the subscription for required security event types and set a callback URL in Security Event.
• Security events are categorized in three categories of OAUTH(Kakao Login), RISC(Risk Incident Sharing and Coordination), and CAEP(Continuous Access Evaluation Protocol). To use RISC and CAEP categories, you need to set a consent item. Request permission through DevTalk.
• Implement a system that handles security event information complying with each security event type's required or recommended security action. Of these, it is recommended to subscribe to User Unlinked and User Scope Withdraw event types in the OAUTH category to delete personal information provided to the service.

3.7. Keep SDK version up to date

Kakao services, including Kakao SDKs, provide security updates. To strengthen security, check the latest version of Kakao SDKs periodically and use the latest version if possible.

3.8. Ask access permission for least data

You must set consent items for the least data only required for your service, which a user will consent to when logging in.

4. Brand guidelines

4.1. Input correct information

To avoid phishing or misleading users into believing your app is provided by another service, you must register the app icon, app name, and company name that correspond to your actual service in Kakao Developers.

4.2. Follow Kakao brand guidelines

When you integrate Kakao Login into your service, comply with Design Guide so that users can recognize that they will sign up through Kakao Login.

We prohibit Kakao trademark infringement. You are prohibited from altering the app name, icon, and company name to something that may mislead users into believing that your service is a Kakao service or partner. For example, you must not add "for Kakao" to your app name or company name.

5. Security incident response

5.1. Prevent additional damage by reissuing app keys

If your app's app keys are revealed, you can reissue the app key by clicking [Reissue] in [My Application] > [App Keys].

If you reissue app keys, you cannot undo and cannot use the old app key anymore. Thus, you must replace the old app keys applied in your service app or website with the new app keys to make Kakao API calls. Otherwise, your API request fails.

5.2. Report security vulnerability

If you find any security vulnerabilities in Kakao services, you can report it through pf.security@kakaocorp.com. If you have any inquiries about the methods or ideas to enhance security in your service using the Kakao platform, contact us through DevTalk.