Toss Payments for WooCommerce connects your store to Toss Payments, one of South Korea's main payment gateways, using the current API and JavaScript SDK (version 2).

The way Korea pays

The customer chooses Toss Payments at checkout and pays in the Toss Payments window: domestic cards, easy pay such as Toss Pay, Naver Pay and Kakao Pay, real-time bank transfer and mobile phone billing. Offer all of them or only the ones in your contract. No card details touch your server.

Approved only when everything matches

After the customer authenticates, the plugin approves the payment with your secret key. Before that it checks that the amount and the order ID on the way back are the ones the order was opened with, so a changed amount is refused. The order is marked paid only when Toss answers DONE for the order's own total.

Refund from the order screen

Press Refund on the order, enter the amount, choose "Refund via Toss Payments". Full and partial cancellations, with your reason passed to Toss.

Test keys, then live keys

Enter your test keys to try everything without real money, then switch to the live keys. An optional webhook keeps orders in step with changes made in the Toss dashboard.

Where this leaves your PCI questionnaire

Because the payment form is the provider's own, SAQ A stays available to you — but PCI DSS v4.0.1 added an eligibility condition: you must be able to confirm your page is not susceptible to script attacks. PCI SSC FAQ 1588 gives two ways to do that. Ask your provider for written confirmation that its embedded payment solution protects the payment page against script attacks, or apply protections of the kind described in requirements 6.4.3 and 11.6.1 yourself. The first is one email and most shops should send it.

Good to know

You need your own Toss Payments account and a store in Korean won. Virtual accounts, automatic recurring billing and escrow are not included. AllPlugin is not affiliated with Toss Payments.