Line login

LINE Login

Do not answer LINE Login questions from memory — LINE updates APIs frequently and training data is unreliable. Always consult the references below.

LINE Login v2.1 is built on OAuth 2.0 and OpenID Connect. It provides user authentication, profile access, and bot linking for web apps, native apps (iOS/Android), Unity, and Flutter.

Workflow

Build

1. Read references/api-common.md (forward compatibility, rate limits, client_secret rules)
2. Read references/security.md (security checklist, development guidelines)
3. Load the relevant reference for the feature being implemented
4. Write code following specs and constraints from references

Review / Debug

1. Read references/api-common.md (status codes, error responses, forward compatibility)
2. Read references/security.md (security checklist, common pitfalls)
3. Load relevant references for the code being reviewed
4. Cross-check code against specs (parameter requirements, token expiry, signing algorithms, required validations)
5. Report violations with reference to specific constraints

Environment Variables

LINE_LOGIN_CHANNEL_ID=LINE Login Channel ID
LINE_LOGIN_CHANNEL_SECRET=Channel secret (ID token verification, token exchange)
LINE_LOGIN_REDIRECT_URI=Registered callback URL

Common Specifications

Read references/api-common.md before writing any LINE Login code. Contains rules that affect all API interactions: forward compatibility (don't use strict schemas — LINE adds fields without notice), rate limits, client_secret conditional requirement by App types, error responses, and logging recommendations.

OAuth 2.1 Authorization Code Flow

User → authorize endpoint → LINE Login screen → callback with code → token exchange → access_token + id_token

Minimal Flow (pseudocode)

# 1. Redirect user to authorize
state = random_token()
session.save(state)
redirect to:
  https://access.line.me/oauth2/v2.1/authorize?
    response_type=code
    &client_id={channel_id}
    &redirect_uri={callback_url}
    &state={state}
    &scope=profile%20openid%20email

# 2. Callback — exchange code for token
if params.state != session.state:
    return 403  # CSRF check failed

POST https://api.line.me/oauth2/v2.1/token
  grant_type=authorization_code
  &code={params.code}
  &redirect_uri={callback_url}
  &client_id={channel_id}
  &client_secret={channel_secret}

# 3. Response
{ access_token, token_type, refresh_token, expires_in, id_token, scope }

Step	Endpoint
Authorize	GET https://access.line.me/oauth2/v2.1/authorize
Token Exchange	POST https://api.line.me/oauth2/v2.1/token

• Scopes: profile, openid, email (space-separated)
• Authorization code: valid 10 minutes, one-time use
• PKCE: recommended for public clients (SPA/Mobile), only S256 supported

Full authorize parameters, PKCE, scope combinations, error codes → references/oauth-flow.md

Token Management

Operation	Endpoint
Verify Access Token	GET https://api.line.me/oauth2/v2.1/verify?access_token={token}
Refresh Token	POST https://api.line.me/oauth2/v2.1/token (grant_type=refresh_token)
Revoke Token	POST https://api.line.me/oauth2/v2.1/revoke
Verify ID Token	POST https://api.line.me/oauth2/v2.1/verify (id_token + client_id)

Token	Validity
Access Token	30 days
Refresh Token	90 days

ID Token signing: HS256 (web login) / ES256 (native app, SDK, LIFF)

Full token APIs, ID Token claims, signing verification → references/token-management.md

User & Bot Linking

Operation	Endpoint
Get User Profile	GET https://api.line.me/v2/profile
Check Friendship	GET https://api.line.me/friendship/v1/status
Deauthorize	POST https://api.line.me/user/v1/deauthorize

• bot_prompt parameter: normal (on consent screen) / aggressive (separate screen after consent)
• friendship_status_changed: included in token response when bot linking is configured

Full user profile, bot linking logic → references/user-profile.md

Security

• state: must be cryptographically random, always validate on callback
• PKCE: use for public clients (SPA, mobile apps)
• Channel Secret: server-side only, never expose to client
• redirect_uri: must be HTTPS
• ID Token: always verify signature before trusting claims

Full security checklist, development guidelines, auto login failure handling → references/security.md

Reference Index

File	Topic
references/api-common.md	Read first. Rate limits, status codes, forward compatibility, client_secret rules, logging
references/oauth-flow.md	Authorization flow, PKCE, scopes, auth methods, error codes
references/token-management.md	Token exchange/refresh/revoke/verify, ID Token claims and signing
references/security.md	Security checklist, development guidelines, auto login failure, login button design
references/user-profile.md	User profile API, Link a Bot, friendship status
references/experts.md	LINE Login domain experts for architecture guidance

SDK

Native SDKs: iOS (Swift) | Android | Unity | Flutter

For web apps, use the OAuth 2.1 flow directly (no SDK required).