Kakao Login for foreign developers

If your product targets Korean users, Kakao Login is the sign-in button they look for first. The setup is not hard, but the console, the consent items and a few response quirks trip up teams who have never shipped in Korea. This is the flow we run in production, written for developers outside Korea.

Academia, Seoul · Updated 2026-11-07

Console setup

Create an app in Kakao Developers and copy its REST API key. Then, on the app management page:

1. Turn Kakao Login on.
2. Register your Redirect URI for every environment you run.
3. Enable the client secret and keep it on the server.
4. Set the consent items you need (nickname, profile image, email and so on). Some items unlock only after the Biz App switch and business information review.

The server flow, with code

This is the shape of the flow running in one of our production apps, trimmed to the essentials. It is plain fetch in TypeScript, so it ports to any backend.

// 1. Send the user to Kakao
const authorizeUrl = (state: string) =>
  "https://kauth.kakao.com/oauth/authorize?" +
  new URLSearchParams({
    response_type: "code",
    client_id: process.env.KAKAO_REST_KEY!,
    redirect_uri: "https://your.app/api/auth/kakao/callback",
    state,
  });

// 2. In the callback: exchange the code, then read the profile
async function kakaoProfile(code: string) {
  const body = new URLSearchParams({
    grant_type: "authorization_code",
    client_id: process.env.KAKAO_REST_KEY!,
    redirect_uri: "https://your.app/api/auth/kakao/callback",
    code,
  });
  if (process.env.KAKAO_CLIENT_SECRET) body.set("client_secret", process.env.KAKAO_CLIENT_SECRET);

  const token = await fetch("https://kauth.kakao.com/oauth/token", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded;charset=utf-8" },
    body,
  }).then((r) => r.json());

  const me = await fetch("https://kapi.kakao.com/v2/user/me", {
    headers: { Authorization: `Bearer ${token.access_token}` },
  }).then((r) => r.json());

  return {
    id: String(me.id),                                   // stable key
    nickname: me.kakao_account?.profile?.nickname ?? me.properties?.nickname ?? null,
    email: me.kakao_account?.email ?? null,              // may be null
  };
}

After kakaoProfile returns, find or create the user by Kakao ID, start your own session, and redirect to the page the user came from. Validate that redirect target against your own paths so the login cannot be used as an open redirect.

Mistakes that break it in production

• Using email as the account key

  Email comes back only when the consent item is set up and the user agrees. Key accounts on the Kakao user ID and treat email as optional, or a share of your sign-ups will fail.

• Redirect URI mismatch

  The redirect_uri in the authorize call, the token call and the console must match exactly, including protocol and path. Register separate URIs for local, staging and production.

• Forgetting the client secret

  If the client secret is enabled in the console, the token request must include it. Turning it on later without updating the server breaks every login at once.

• Reading the nickname from one place only

  Depending on app settings, the nickname arrives under kakao_account.profile or under the older properties field. Read both.

• Skipping the state parameter

  Generate a random state, store it in the session and compare it in the callback. It is the CSRF check for the whole flow.

Consent items and Biz App review

Kakao states that some consent items can be configured only after additional permissions are enabled: you switch the app to a Biz App, check eligibility and pass a business information review. This is where teams outside Korea get stuck.

• The standard Biz App switch expects a Korean business registration number.
• There is an individual developer Biz App option in the console (App → General → Business information) for apps without a business number.
• Overseas organisations on Kakao's developer forum report that this path still asked for Korean identity or Korean mobile verification they could not provide. Others have filed requests with US incorporation documents (Articles of Organization or EIN) and were pointed back to the console setting.

So plan for it before your sign-up flow depends on email. Either design the account around the Kakao user ID with email optional, or have the app owned by an entity that can pass the Korean verification, such as a Korean subsidiary or a Korean partner company.

The rest of the Korea stack

Kakao Login is usually the first of several Korea-specific pieces: local card payments and wallets (Toss Payments, KakaoPay, Naver Pay), Kakao or Naver maps instead of Google Maps, and Korean UX copy that does not read like a translation. If you are building on a Korean government program timeline such as the K-Startup Grand Challenge, the MVP also has to be ready before the evaluation date.

See our work for apps we have shipped for Korean users.