> For the complete documentation index, see [llms.txt](https://tech.x2bee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tech.x2bee.com/api-guide/api-guides-en/store-front/member/login.md).

# Login

Provides authentication functions that allow enrolled members to log in to the X2BEE shopping mall and access their account. Through this, members can enter their personal information and log in to enjoy a personalized shopping experience. Login supports both general login and simple login (Kakao, Naver), and also includes dormant member restoration when a dormant member logs in through identity verification.

***

## Key Features

* **General Login**
  * Members who have completed sign-up can log in by entering their ID and password.
* **Simple Login**
  * Members who completed sign-up via Kakao or Naver authentication can log in easily through the corresponding social channel.
* **Dormant Member Restoration**
  * If a dormant member logs in via identity verification, dormant member restoration processing can be performed.
* **Token Issuance**
  * Upon successful login, an access token (AccessToken) and a refresh token (RefreshToken) are issued.
* **Token Types**
  * **Access Token (AccessToken)**: Issued for site usage and valid for 2 hours.
  * **Refresh Token (RefreshToken)**: Used to renew the access token once it expires, and is valid for 3 hours.
* **Information Included in accessToken**
  * **mbrNo:** Member number
  * **langCd**: The member's sign-up site country and login location
* **Registration to Redis Storage**
  * Upon login, the information is registered to Redis storage so each module can check permissions and use the UserDetail (member basic information).
* **CAPTCHA Code Verification**
  * CAPTCHA code verification is performed to prevent brute-force attacks after more than 3 login errors.

## Process Definition

<figure><img src="https://2999922013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXTxKSWMmuxEkop1pvuwe%2Fuploads%2Fidw2eGMI5UGBE79QdU7z%2F%E1%84%85%E1%85%A9%E1%84%80%E1%85%B3%E1%84%8B%E1%85%B5%E1%86%AB.png?alt=media&#x26;token=79b1a9a4-25a8-4c93-b01c-103aa28cfd39" alt=""><figcaption></figcaption></figure>

{% stepper %}
{% step %}

### Login Request

The user enters a username and password on the login page in the client application to attempt login. When a customer logs in, they enter their member ID and password, which is sent to the server as an authentication request; the server verifies the user's identity, after which the customer can use the site.
{% endstep %}

{% step %}

### Simple Login

Simple login allows a user to easily log in to the website by linking a social media account.\
When implementing social login, authentication protocols such as OAuth 2.0 and OpenID Connect are used to integrate with social media platforms and obtain user authorization to complete the login process. This allows users to conveniently log in to the service using their social media account.
{% endstep %}

{% step %}

### Token Issuance

Token issuance mainly refers to the process of providing the client with an access token and a refresh token after user authentication.\
The access token is valid for 2 hours, after which it loses its authority and the site can no longer be used.\
The refresh token is valid for 3 hours, after which it loses its authority and the access token can no longer be renewed.
{% endstep %}

{% step %}

### Social Account Verification

The social account verification process validates the personal information received from the social channel. During this validation process, the system determines whether the user is a member of the X2BEE shopping mall, and branches to either sign-up or login processing.
{% endstep %}

{% step %}

### CAPTCHA Code Generation

A CAPTCHA code is a security method used on websites or applications to prevent automated sign-ups, spam, and bot attacks.\
It is activated after 3 password errors to determine whether the user is a bot or a human.
{% endstep %}
{% endstepper %}

## API Function List

<table><thead><tr><th width="111.2222900390625">API</th><th width="372.3333740234375">Description</th><th width="98">Server</th><th width="90.22216796875">Method</th><th>Remarks</th></tr></thead><tbody><tr><td>Login</td><td>When logging in, two tokens required for site usage are generated: accessToken and refreshToken. The accessToken is used to confirm that a request to each module was made by a properly logged-in user, and the refreshToken is used to generate a new accessToken once the accessToken's validity period has expired.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=login">🔗View API></a></td></tr><tr><td>Logout</td><td>Deletes the refreshToken information generated at login from the database.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=logout">🔗View API></a></td></tr><tr><td>Social Login Processing</td><td>Logs in using a social account. Supported when the social account is linked, or when the member signed up using the social account.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=connect">🔗View API></a></td></tr><tr><td>Token<br>Refresh</td><td>When the accessToken generated at login has expired, uses the refreshToken to generate a new accessToken and extend its validity period.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=refreshToken">🔗View API></a></td></tr><tr><td>Social Account Verification</td><td>Uses the social account information and identity verification CI value to determine member status and whether the social account is linked, and supports the service of processing login if the social account is linked, providing a permission message for linking if the social account is not linked, and redirecting to the sign-up page if the user is not a member.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=check">🔗View API></a></td></tr><tr><td>Token Login</td><td>Uses the token for auto-login and biometric login to generate an accessToken and refreshToken that can be used for site access.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=tokenlogin">🔗View API></a></td></tr><tr><td>Token<br>Issuance</td><td>Generates a token for auto-login and biometric login; this token is managed both by its own validity period and by the server's database. The validity period of this token is 10 years.</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=saveAutoToken">🔗View API></a></td></tr><tr><td>Token<br>Deletion</td><td>Deletes the token information generated for auto-login and biometric login from the database.</td><td>Member</td><td>DELETE</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=deleteAutoToken">🔗View API></a></td></tr><tr><td>Dormant Member<br>Restoration Processing</td><td>Restores the separately stored personal information of a dormant member to normal member status.<br>api/goods/v1/qnaWithdraw/updateRecoveryQna api/order/v1/member/restoreMemberOrderInfo api/order/v1/customerservice/restoreMember api/event/v1/common/undoSeparate api/event/v1/common/mergeMbrBase api/event/v1/common/mergeMbrDlvp</td><td>Member</td><td>POST</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=stopMemberCancel">🔗View API></a></td></tr><tr><td>CAPTCHA Code to Speech</td><td>Converts the generated CAPTCHA code to speech when it is difficult to identify visually.</td><td>Member</td><td>GET</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=createCaptchaTextToAudio">🔗View API></a></td></tr><tr><td>CAPTCHA Code Generation</td><td>When login fails more than 3 times, randomly generates a 6-digit number to prevent brute-force attacks and other security issues.</td><td>Member</td><td>GET</td><td><a href="http://api.x2bee.com/content?msa=member&#x26;depth=%EB%A1%9C%EA%B7%B8%EC%9D%B8&#x26;path=createCaptchaImg">🔗View API></a></td></tr></tbody></table>

## Definition of Terms

<table><thead><tr><th width="192.888916015625">Term</th><th>Description</th><th data-hidden>Remarks</th></tr></thead><tbody><tr><td>CAPTCHA Code</td><td>One of the security mechanisms used on websites or applications to prevent automated sign-ups, spam, and<br>bot attacks. A CAPTCHA code is a test that allows the system to determine whether the user is a human or a robot, typically implemented by displaying distorted letters or numbers and asking the user to recognize them.</td><td></td></tr><tr><td>Access Token</td><td>A string used to prove that a client has been granted permission to access server resources. An access token is valid<br>only for a limited period and can be reissued or revoked as needed.</td><td></td></tr><tr><td>Refresh Token</td><td>One of the security tokens used in the OAuth 2.0 protocol. It is mainly used to obtain a new access token after the access token has expired.</td><td></td></tr><tr><td>Simple Login</td><td>A feature used to log in to another website or app using a social media account or another online service account.</td><td></td></tr><tr><td>Dormant Member</td><td>Refers to a member who has not logged in or used the service for a certain period. A user is considered dormant if they have not logged in or used the service for 1 year.</td><td></td></tr></tbody></table>

## Other Notes

* **Authentication and Authorization**
  * The accessToken and refreshToken generated via JWT authentication at login each have their own validity period set within the token, and authentication fails once that period has passed.
  * Tokens generated through login are stored in the server-side ET\_MBR\_CERTI\_TKN\_ISSU\_INFO table.
  * When logging in or renewing with the refresh token, or with the auto-login or biometric authentication token, authentication and authorization are double-checked based on the token's own validity period and its existence in the ET\_MBR\_CERTI\_TKN\_ISSU\_INFO table.
* **Member Information Redis Cache Registration**
  * Upon successful login, the generated UserDetail information is registered to Redis storage, and each module retrieves the UserDetail information using the accessToken issued at login when making API requests.
  * UserDetail records the member name, member number, member management code (ME002), member classification code (ME001), login ID, member grade code (ME008), employee status, gender classification code (ME017), adult verification status, age, country code, and company classification code (ME038).
* **Dormant Member Restoration**
  * The password is entered to confirm the account owner, and if the password matches, the data stored in the separate storage database is transferred to the general database.
  * When restoring a dormant member, the api-member data is restored first; once the restoration succeeds, a request is sent to each module's API for dormant member restoration processing.
  * If a module fails during the restoration process, the information of the failed module is recorded in the ET\_STP\_MBR\_FAIL\_INFO table and later re-executed via the reTrySeparateJob batch.
* **CAPTCHA Code**
  * The SimpleCaptcha library is used for the CAPTCHA code.
* **Login Restriction**
  * At login, the country code of the site where login is attempted is compared with the country code registered at sign-up; login is restricted if they do not match.
* **Token Login Supports Auto-Login and Biometric Login**
  * To enable auto-login, the auto-login checkbox must be checked before logging in; the auto-login token has a validity period of 10 years.
  * Biometric login is an app-only service and can be enabled through My Page settings after logging in via the app. The biometric login token has a validity period of 10 years.
* **Social Login**
  * Social login can be used after initially signing up through a social channel, or after linking a social channel account through My Page settings while logged in as a general member.
  * X2BEE shopping mall currently supports social login via Kakao and Naver accounts.
* **Identity Verification Service Configuration and Development**
  * To enable auto-login, the auto-login checkbox must be checked before logging in; the auto-login token has a validity period of 10 years.
  * Biometric login is an app-only service and can be enabled through My Page settings after logging in via the app. The biometric login token has a validity period of 10 years.

### Naver / Kakao Configuration Example

### Naver Login

* Module: API-MEMBER
* Configuration files: `application-local.properties`, `application-dev.properties`
* Application properties:

```properties
social.login.naver.clientId=issued clientId
social.login.naver.clientSecret=issued clientSecret
```

* Naver Login related API: [Naver Developer Link >](https://developers.naver.com/main)
  * User lookup token issuance URL: <https://nid.naver.com/oauth2.0/token>
  * User lookup URL: <https://openapi.naver.com/v1/nid/me>
* Mobile environment (env.local, env.dev) environment variables:

```env
NAVER_LOGIN_KEY=issued Key
```

***

### Kakao Login

* Module: API-MEMBER
* Configuration files: `application-local.properties`, `application-dev.properties`
* Application properties:

```properties
social.login.kakao.clientId=issued clientId
```

* Kakao Login related API: [Kakao Developer Link >](https://developers.kakao.com/)
  * User lookup token issuance URL: <https://kauth.kakao.com/oauth/token>
  * User lookup URL: <https://kapi.kakao.com/v2/user/me>
* Mobile environment (env.local, env.dev) environment variables:

```env
KAKAO_LOGIN_KEY=issued Key
```

<br>

* **Logout**
  * When logging out, the refreshToken and the auto-login/biometric authentication tokens are deleted, restricting any subsequent authentication requests made with those tokens.