Kurly · Authentication Profile

Kurly Authentication

Authentication

Kurly secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyTechnologyLogisticsFulfillmentSupply ChainDeliveryEcommerceGroceryShippingOrder ManagementInventoryTrackingSouth Korea
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://developers.kurly.com/docs/auth
docs: https://developers.kurly.com/docs/auth
api: Kurly Logistics Services (KLS) Open API
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_in: []
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
  self_service: false
  network_control: ip-allowlist

schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: >-
    Access token issued by POST /auth/token using the clientId/secretKey pair Kurly issues after IP
    allowlist registration. Sent as `Authorization: Bearer {AccessToken}`.
  header: Authorization
  format: 'Bearer {AccessToken}'
  sources:
  - openapi/kurly-kls-delivery-agency-openapi.yml
  - openapi/kurly-kls-delivery-tracking-openapi.yml
  - openapi/kurly-kls-fulfillment-openapi.yml
  docs: https://developers.kurly.com/docs/auth

token_issuance:
  operation: issueToken
  endpoint: POST /auth/token
  credentials:
  - clientId
  - secretKey
  docs: https://developers.kurly.com/docs/api/인증/토큰-발급
  responses:
    '200': Authentication succeeded (인증 성공)
    '400': Authentication error (인증 오류)
  expiry: not published
  refresh: not published

credential_issuance:
  self_service: false
  process: >-
    The shipper submits the list of IP addresses that will call the API via Kurly's Google Form.
    Kurly issues the clientId and secretKey by reply within a maximum of 5 business days.
  form: https://docs.google.com/forms/d/18MuePJjYaalk6KOXF61Mts6hVPJAyDlxndK_Q8SjxBs/edit
  turnaround: up to 5 business days
  prerequisite: an existing fulfillment or delivery-agency contract with Kurly
  docs: https://developers.kurly.com/docs/auth

network_controls:
  ip_allowlist:
    required: true
    description: >-
      Calls are only accepted from IPs the shipper registered with Kurly. Allowlisting is a
      precondition of credential issuance, not an optional hardening step.
    docs: https://developers.kurly.com/docs/intro

scopes:
  supported: false
  note: >-
    KLS has no OAuth scope or permission surface — authorisation is implied by the shipper's contract
    and the credentials issued against it. No scopes/ artifact is emitted for this provider.

test_environment:
  available: true
  self_service: false
  requirements:
  - Complete Kurly security training (보안 교육 수료)
  - Sign a security pledge (보안 서약서 작성)
  - Follow the VPN and firewall guidance
  artifact: sandbox/kurly-sandbox.yml
  docs: https://developers.kurly.com/docs/faq

support:
  email: logistics-dev@kurlycorp.com