Native SDK coverage
The Core, User, Social, Channel, Share, Navi, and Cert packages expose the public service APIs of the Kakao Android and iOS SDKs. Web uses the JavaScript SDK and REST APIs available to user access tokens. Browser limitations for app switching, local keys and sessions, and SDK URL builders are listed below.
Implementation coverage and verified success responses are separate. Success paths that require an approved app or an installed Kakao app are listed under Verification coverage.
SDK versions and audit scope
Native defaults come from sdkVersions in packages/core/package.json. Overrides can change the behavior described here. Use getKakaoSDKInfo() to inspect the running version.
| SDK | Version | Scope |
|---|---|---|
| Android | 2.25.1 | Common, Auth, User, Talk, Friend, Share, Template, Navi, Cert |
| iOS | 2.29.0 | Public SDK products for the same services |
| Partnership friend picker | Android 1.0.0, iOS revision 83917aaf996e5d4072e73b681507228fbd967d42 | Partnership friend selection options |
| JavaScript verification environment | 2.8.4 | The app installs its SDK script using Web setup |
The audit covers public service methods, input options, and response fields in these SDKs. Internal methods, retired APIs, and callback/async overloads of the same operation are not duplicated as separate JS APIs. SDK client replacement and token-store replacement are not exposed. Push, Talk Calendar, administrator REST APIs, and the separate Kakao Maps SDK are outside this native SDK comparison. See Kakao's official support matrix for the wider API catalog.
Public APIs by feature
Unless a platform is specified, the features below are implemented on both Android and iOS. The Web column describes browser behavior.
Core
| Feature | Public APIs and options | Web |
|---|---|---|
| SDK initialization | initializeKakaoSDK, customScheme, loggingEnabled, android.sdkIdentifier | Initializes with JavaScript and REST API keys. Native options do not apply. |
| Version and initialization state | getKakaoSDKInfo | Returns version and isInitialized, without native configuration fields. |
| Android key hash | getKeyHashAndroid | Returns undefined. This utility is Android only. |
User
| Feature | Public APIs and options | Web |
|---|---|---|
| Talk/account login and additional consent | login: useKakaoAccountLogin, scopes, prompts, serviceTerms, nonce, loginHint, channelPublicIds, android.requestCode | Redirects to authorization. Requires web.redirectUri and subsequent authorization-code handling. |
| Login-method selector | loginWithKakao, UI and login options | Rejects with Package-UnsupportedPlatform. |
| Token refresh | refreshToken: stored token or an explicit token, iOS request-level loggingEnabled | Rejects with Package-UnsupportedPlatform. |
| Exchange an authorization code (iOS) | issueAccessTokenWithCode: code, PKCE codeVerifier, redirectUri | Uses REST, returns the same token shape, and stores the access token. |
| Stored token, validity, and token information | hasToken, isLogined, getAccessToken | Supported. hasToken checks storage and does not guarantee token validity. |
| Logout and unlink | logout, unlink | Supported. |
| KakaoTalk login availability | isKakaoTalkLoginAvailable | Always false. Browsers do not determine installation state. |
| User data and images | me: secureResource, default-image and birthday metadata, UUID | Supported, subject to consent and app permissions. |
| Legal identity and group user token | me: legalName, legalBirthDate, legalGender, agreement fields, groupUserToken | The same fields are exposed. Partnership or group configuration is required. |
| Save user properties | updateProfile | Supported for property keys registered in the console. |
| Manual connection | signup, signup properties | Supported for apps approved for manual connection. |
| Query and revoke scopes | scopes, revokeScopes | Supported. |
| Query and revoke service terms | serviceTerms, revokeServiceTerms, result and tag filters | Supported. |
| Query shipping addresses | shippingAddresses: addressId, fromUpdatedAt, pageSize | Calls the REST API with the user token. |
| Select a shipping address | selectShippingAddress | Uses the JavaScript SDK popup and returns the address ID. |
Login options cannot be combined arbitrarily. See Login and Web login for the pinned SDK's additional-consent/login-hint restrictions and web precedence rules. The web-only issueAccessTokenWithCodeWeb and setAccessTokenWeb are unsupported on native platforms.
Social and Channel
| Feature | Public APIs and options | Web |
|---|---|---|
| KakaoTalk profile | getTalkProfile | Supported. |
| Friends list | getFriends: offset, limit, order, friendOrder | Supported. |
| Standard friend picker | selectSingleFriend, selectMultipleFriends: search, self profile, favorites, selection counts, selected-friend display, appearance, orientation, index | Uses the JavaScript SDK popup. mode, viewAppearance, orientation, and enableIndex do not apply. |
| Partnership friend picker | selectSinglePartnerFriend, selectMultiplePartnerFriends: registration, country and OS filters, selection restrictions, expanded profiles | Forwards supported options to the JavaScript SDK. Unconnected friends and other partnership features require approval. |
| Channel relationships | channels, channelPublicIds | Supported. |
| Add a channel or start a chat | addChannel, chatChannel | Supported. |
| Channel URLs | getAddChannelUrl, openAddChannelUrl, getChatChannelUrl, openChatChannelUrl | Supported. get returns the URL; open opens it. |
| Follow a channel | followChannel | Uses the JavaScript SDK consent flow. |
Share
The six default templates are feed, list, location, commerce, text, and calendar. Each has share, send-to-me, and send-to-friends functions. For example, feed uses shareFeedTemplate, sendFeedTemplateToMe, and sendFeedTemplateToFriends.
| Feature | Public APIs and options | Web |
|---|---|---|
| Default and custom template sharing | Default templates, shareCustomTemplate, template arguments, server callbacks, browser fallback | Uses the JavaScript SDK. |
| URL scrap sharing | shareScrapTemplate, default or custom template | Supported. |
| Send to self or friends | Default templates, custom, scrap | Supported. Requires login, message consent, and recipient permissions. |
| Detailed friend-message results | includeFailureInfo: true | Returns successful UUIDs and recipient errors in the same shape. The default is a successful UUID array. |
| Share target picker settings | pickerSettings | Forwarded to the JavaScript SDK. See verification coverage for native KakaoTalk UI effects. |
| Local image upload and remote image scraping | uploadImage, scrapImage, secureResource | Supported. Uploads from the supplied image URI. |
| Sharing URL builders | makeDefaultTemplateUrl, makeCustomTemplateUrl, makeScrapTemplateUrl | Reject with Package-UnsupportedPlatform. |
| Template warning and argument diagnostics | getShareTemplateDiagnostics | Rejects with Package-UnsupportedPlatform. |
| KakaoTalk sharing availability | isKakaoTalkSharingAvailable | Always false. This does not indicate whether web sharing works. |
See Component types for button, image, social, commerce, item, and execution-parameter fields. Pass execution-parameter keys and values as unencoded strings. URL builders do not open apps or pages; diagnostics do not send messages.
Navi and Cert
| Feature | Public APIs and options | Web |
|---|---|---|
| Kakao Navi installation | isKakaoNaviInstalled | Always false. Browsers do not determine installation state. |
| Navigation and destination sharing | navigateTo, shareTo: destination, stops, rpflag, route options, installation-page fallback | Calls the JavaScript SDK on mobile browsers and returns false on desktop. |
| Kakao Navi URL builders | getNavigateUrl, getShareUrl, up to three stops and native route options | Reject with Package-UnsupportedPlatform. |
| Certification login | certLoginWithKakaoTalk, certLoginWithKakaoAccount, product-specific K2100/K2220 inputs and login options | Native functions are unsupported. K2100 uses the authorizeForCertWeb redirect. |
| Exchange a certification code (iOS) | issueCertTokenWithCode: authorization code, PKCE verifier, redirect URI | Rejects with Package-UnsupportedPlatform. |
| Public key and stored session | getPublicKey, getSessionInfo, isValidSession, deleteKeyPair | Reject with Package-UnsupportedPlatform. |
| Fetch server sessions | fetchSessionInfo, fetchSessionInfoByAppKey | Reject with Package-UnsupportedPlatform. |
| KakaoTalk signing and reduced signing | isKakaoTalkSignAvailable, signWithKakaoTalk, reducedSign, K2220/K3220 | Availability is false; signing functions reject with Package-UnsupportedPlatform. |
Certification requires Kakao approval and server transactions. authorizeForCertWeb is web only; completing its redirect request does not complete authentication or signing. Calling it on native rejects with Package-UnsupportedPlatform.
Response contracts
Timestamps use Unix seconds; validity durations use seconds. SDK keys and enums are mapped to the public TypeScript types. null or absent fields caused by missing consent or app permissions are not filled with invented success data.
Existing sharing and messaging success values can differ by platform. Do not infer delivery from these values; consult each function’s return type. Friend sends return successful UUIDs by default, or { successfulReceiverUuids, failureInfos } with detailed results enabled. Message receipt, completed app switching, and authentication after a web redirect require separate checks in each flow.
Asynchronous data queries and mutations propagate SDK/HTTP failures as Promise rejections. Status and launch functions such as isLogined, navigateTo, and shareTo can return false for token-query or SDK-launch failures. JavaScript input validation can throw synchronously before returning a Promise. Follow each API's guide for its return type and error handling.
Verification coverage
The following records runtime verification performed through October 21, 2026. Check each PR separately for its latest commit’s RN 0.76 builds and RN 0.88 builds/E2E results. Builds and input/response checks do not verify success paths when app permissions or installation prerequisites are missing. Each PR's Confidence level describes the scope verified for that change.
Earlier authenticated checks also used Android 2.25.0 and JavaScript 2.7.1. The SDK update and subsequent PRs record the checks performed after version updates. Not every authenticated success flow below was rerun with Android 2.25.1 and JavaScript 2.8.4.
| Feature | Verified | Remaining success paths or conditions |
|---|---|---|
| Module integration | Android/iOS Release builds and 8/8 smoke tests per platform. Channel, Social, and Share also build with only Core + the selected module installed. | Feature approval and authentication are separate prerequisites. |
| SDK initialization and information | Native settings, Android identifier KA header application/restoration and iOS ignoring it, actual web SDK version and initialized state | Authentication callback with a registered custom multi-app scheme |
| Login selector and refresh | Account selector login and stored-token refresh on Android/iOS; signed-out errors and cancellation on both platforms | Installed-KakaoTalk switching and callbacks |
| Android login request code | Signed 32-bit integer bounds, out-of-range rejection, account-login fallback, and cancellation | Forwarding with KakaoTalk installed. The pinned SDK uses this value only in diagnostic logs. |
| Login hint | Android 2.25.1, iOS 2.29.0, and web 2.8.4: fixture ID prefill, login after entering the test account, token storage, and server validity checks passed. iOS screenshot, Android screenshot. | The returned web callback URL was passed through a temporary masked input before code exchange. Automatic callback-server delivery remains unverified. |
| Explicit-token refresh | Android 2.25.1 / iOS 2.29.0: refresh, storage, and validity passed after exchanging valid same-app tokens with an empty SDK store. Invalid tokens returned InvalidGrant; web returned its unsupported error | Unrotated refresh expiry differed by up to approximately 0.09s in these checks. |
| iOS refresh request logging | Debug app: true logs the request and response body; false hides both. Both return InvalidGrant, and global SDK logging remains false | The SDK still logs a response: - placeholder. |
| Authorization code exchange | iOS 2.29.0 and web 2.8.4: valid regular codes with PKCE issued tokens, stored them, and passed server validity checks. Invalid regular/certification codes, unsupported-platform errors, and 24 contract checks also passed | Successful certification-code exchange requires an app approved for Kakao certification. |
| Properties, terms, address selection | Property writes and empty-value restoration; readback on the previously verified branch, optional-term consent/revocation with readback, and address ID return on all three platforms | Manually closing the web popup can leave the SDK Promise pending. |
| Address queries | Android 2.25.1, iOS 2.29.0, and web 2.8.4: two-address first pages and empty final pages requested with the actual modification timestamp. Authenticated web ID lookup matched one address. | Checked with two stored addresses. Traversal through multiple intermediate pages remains unverified. |
| User profile | Image selection, default-image and unavailable-field responses on all three platforms; input mapping | Populated birthday metadata, UUID, legal identity, group token, and real enum/consent responses |
| Manual connection and login channels | Registered-user errors, channel configuration errors, input/response mapping | Successful signup in an approved manual-connection app, partnership/group data, and connected-channel consent |
| Social | Standard picker selection on all three platforms and authenticated Android/web queries | Large-list index/pagination, authenticated iOS responses, partnership filters/profile selection |
| Channel | Channel URLs; filtered and unfiltered queries returned Permission on iOS 2.29.0 | Successful connected-channel payloads and filtered queries |
| Images | Upload/scrap on all three platforms, native size boundaries, and Android document URI denial followed by a successful upload with a read grant | The calling app needs read permission for Android content:// URIs. |
| Scrap messages | Kakao accepted 12 requests across three platforms, self/friend recipients, and default/custom templates | Final chat rendering, detailed friend-message results, and recipient partial failures |
| Sharing URLs and diagnostics | Native templates/arguments/special characters, actual iOS warning responses, web unsupported errors | Android diagnostics success needs KakaoTalk installed. Valid calendar IDs, populated argumentMsg, and KakaoTalk picker UI effects are also unverified. |
| Kakao Navi | Native route options/stops in URLs, unavailable-app results, mobile/desktop web branches | Actual delivery and navigation in an installed Kakao Navi app |
| Certification | Native local keys/sessions/deletion, error/cancel paths, web unsupported and authorization errors | Token issuance, valid sessions, and completed signatures with an approved app and server transaction |
On Android 2.25.1, a document URI uploaded successfully after receiving a temporary read grant, returning a 74-byte, 2×2 PNG. The file downloaded from the returned HTTPS URL matched the input image byte for byte.
Login, token refresh, and shipping-query evidence is recorded in the PRs for selector login, explicit-token refresh, shipping queries, and SDK updates.
Evidence and limitations for other features are recorded in the PRs for image uploads, properties, scrap messages, partnership pickers, certification, sharing URLs, and template diagnostics.