Integration Preparation

This guide covers the prerequisites and key information required before integrating the Easy Cash Direct Debit (Open Banking) API.

Environment Keys

Sandbox and Production environments are fully isolated and use separate Merchant IDs and keys.

Environment	Merchant ID	Auth Key	Purpose
Sandbox	Shared test Merchant ID	Shared test key	Development and testing (no actual transfers occur)
Production	Merchant-specific ID	Merchant-specific key	Live service (actual transfers occur)

Merchant Key Provisioning (Post-Contract)

After signing a contract with Hecto Financial, you will receive the following credentials for the Production environment.

Item	Description
Merchant ID (mchtId)	Unique merchant identifier.
Hash generation key	SHA-256 key for tamper protection.
Encryption key	AES-256 key for protecting personal and sensitive data.

NOTE

Provisioned via Sales Representative

Merchant IDs, encryption keys, and hash generation keys for both Sandbox and Production are issued through your Hecto Financial sales representative. Key values shown in this specification are example data for illustration purposes only.

Server Integration Environment

Server Addresses and Network Information

Easy Cash Direct Debit APIs are called directly from your backend server using JSON over HTTPS.

Account management, transfer, and inquiry service APIs all use the same server environment.

Environment	Domain	IP Address	Protocol
Sandbox	tbnpay.settlebank.co.kr	61.252.169.31	HTTPS (TCP/443)
Production	npay.settlebank.co.kr	61.252.169.27 (Primary) 14.34.14.24 (Secondary)	HTTPS (TCP/443)

NOTE

Dual-IDC Redundancy

• The Hecto Financial Easy Cash system operates with Primary and Secondary data centers for high availability. • If the Primary center fails, traffic automatically switches to Secondary. Allow both Primary and Secondary IPs in your firewall rules. • DNS-based connection is recommended — failover is handled automatically. Hardcoding IP addresses in the hosts file will prevent automatic failover.

Development Requirements

Easy Cash Direct Debit integration requires a backend server.

Layer	Role
Backend (required)	HMAC signature generation, personal data encryption, payment processing, response verification
Frontend	Identity verification screen invocation (if applicable)

Backend Server Required

For security reasons, HMAC signature generation and personal data encryption must be performed server-side. A frontend-only integration is not supported.

Encryption and Tamper Protection

Easy Cash Direct Debit uses two security mechanisms to protect data.

Personal and Sensitive Data Encryption

Encryption scheme used to protect personal and sensitive data.

Item	Detail
Algorithm	AES-256 / ECB / PKCS5Padding
Encoding	Base64
Encrypted fields	Manager name, landline number, mobile number, email, account holder name, account number, etc.
Sandbox key	pgSettle30y739r82jtd709yOfZ2yK5K (32 bytes)
Production key	Issued separately after contract

Tamper-Protection Hash

Hash generation scheme used to verify data integrity.

Item	Detail
Algorithm	SHA-256
Encoding	Hex
Sandbox key	ST1009281328226982205 (21 bytes)
Production key	Issued separately after contract
Generation method	Concatenate parameters → SHA-256 hash → Hex encode

Hash Validation Required

• Requests: Generate and include the hash in every request. Requests with mismatched hashes will be rejected. • Responses: Verify the hash on every response. Skipping verification exposes your integration to tampering attacks.

Important Notes

Testing in Production

Production Environment Testing

Any testing in the Production environment must be coordinated with your Hecto Financial representative in advance. Costs incurred from uncoordinated production test transactions are the merchant's responsibility.

API Request Guidelines

POST only — All APIs support POST method exclusively.
JSON format — All requests and responses use application/json;charset=UTF-8.
Prohibited characters — The following characters cannot be included in field values: :, &, ?, ', newline, <, >.
Parameter validation — Missing required fields, hash mismatches, or length violations return an error response.

{
  "outStatCd": "0031",
  "outRsltCd": "ST09",
  "outRsltMsg": "Invalid request message"
}

Response Parameters May Change

Response Parameters Subject to Change

Response parameters may be added or modified without prior notice. Design your integration to be resilient to parameter changes.

Network and Protocol Requirements

TLS 1.2 or higher required — HTTPS (port 443) only.
Timeout — API response timeout is 30 seconds.
Firewall rules — Both Primary and Secondary Production IPs must be allowed.
Avoid hosts file overrides — Hardcoded IPs prevent automatic IDC failover.

Integration Steps

Step-by-Step Guide

Basic Integration Flow

End-to-end guide: authentication, account enrollment, and payment

Identity Verification

Mobile, ARS, and micro-deposit verification

Account Management

Account enrollment, inquiry, and cancellation

Payment Processing

Direct debit capture, void, and refund

Service Documentation

API by Feature

Identity Verification

Mobile verification, ARS verification, micro-deposit verification

Account Management

Account enrollment, Open Banking enrollment, account list inquiry

Transfer Services

Payment capture, remittance, void/refund

Inquiry Services

Transaction result inquiry, transaction history inquiry

Fund Return Claim

Fund return claim request and confirmation

Need technical support?

Code Samples

HectoFinancial GitHub