Integration Prerequisites

This guide covers the prerequisites and essential information you need to know before integrating the Easy Cash Direct Debit (Open Banking) API.

Credentials by Environment

The Sandbox and Production environments are separate, each using distinct Merchant IDs and keys.

Environment	Merchant ID	Auth Key	Purpose
Sandbox	Shared test Merchant ID	Shared test key	Development and testing (no actual transfers occur)
Production	Merchant-specific ID	Merchant-specific key	Live service (actual transfers occur)

Merchant-Specific Key Issuance (Post-Contract)

After signing a contract with Hecto Financial, you will receive the following credentials for use in the Production environment.

Item	Description
Merchant ID (mchtId)	Unique merchant identifier
Hash generation key	Key for generating hashes to prevent tampering (SHA-256)
Encryption key	Key for protecting personal and sensitive data (AES-256)

NOTE

Issuance via sales representative

The Merchant ID, encryption key, and hash generation key for both the Sandbox and Production environments must be obtained through your Hecto Financial sales representative. The key values referenced in this integration guide are sample data for illustrative purposes only.

Server Integration Environment

Server Address and Network Information

The Easy Cash Direct Debit (Open Banking) API is called directly from your server in JSON format.

Account management, transfer service, and inquiry service APIs all use the same server environment.

Environment	Domain	IP Address	Protocol
Sandbox	tbnpay.settlebank.co.kr	61.252.169.31	HTTPS (TCP/443)
Production Primary	npay.settlebank.co.kr	61.252.169.27	HTTPS (TCP/443)
Production Secondary	npay.settlebank.co.kr	14.34.14.24	HTTPS (TCP/443)

NOTE

IDC redundancy configuration

• The Hecto Financial Easy Cash Direct Debit system uses a Primary and Secondary data center for redundancy. • In the event of a Primary center failure, traffic automatically switches to the Secondary center. Allow both Primary and Secondary IPs in your firewall settings. • DNS Lookup connections are recommended — switchover is handled automatically. (Hardcoding IPs in the hosts file will prevent automatic failover.)

Development Environment Requirements

Easy Cash Direct Debit integration requires a backend server.

Component	Role
Backend (required)	Hash generation, personal data encryption, payment processing, result verification
Frontend	Identity verification screen invocation (if applicable)

Backend server is required

For security reasons, hash generation and personal data encryption must be performed on the server side. A frontend-only integration of Easy Cash Direct Debit is not supported.

Encryption, Decryption, and Tamper Prevention

Easy Cash Direct Debit uses two layers of security to protect data.

Personal and Sensitive Data Encryption

Item	Details
Algorithm	AES-256 / ECB / PKCS5Padding
Encoding	Base64 encoding
Data to encrypt	Contact name, phone number, mobile number, email, account holder name, account number, etc.
Sandbox key	pgSettle30y739r82jtd709yOfZ2yK5K (32 bytes)
Production key	Issued separately after contract

Tamper Prevention Algorithm

Item	Details
Algorithm	SHA-256
Encoding	Hex encoding
Sandbox key	ST1009281328226982205 (21 bytes)
Production key	Issued separately after contract
Generation method	Combine parameters → SHA-256 hash → Hex conversion

Hash verification is mandatory

• Request: Generate and include the hash when sending (requests with mismatched hashes are rejected). • Response: Verify the hash before processing (skipping verification exposes you to tampering attacks).

Important Notes

Production Environment Testing

Production environment testing

Testing in the Production environment requires prior coordination with your Hecto Financial representative. Any costs incurred from production testing conducted without prior agreement are the merchant's responsibility.

API Request Guidelines

POST method only — All APIs support POST only
JSON format — Both requests and responses use application/json;charset=UTF-8
Special character restrictions — The following characters cannot be transmitted: :, &, ?, ', new line, <, >
Parameter validation — Missing required fields, hash mismatch, or parameter length violations return an error response

{
  "outStatCd": "0031",
  "outRsltCd": "ST09",
  "outRsltMsg": "Invalid request message"
}

Response Parameters May Change

Response parameters may change

Response parameters are subject to change without prior notice. Implement your integration in a way that is resilient to parameter changes.

Network and Protocol Requirements

TLS 1.2 or higher required — HTTPS (port 443) only
Timeout — API response timeout is 30 seconds
Firewall settings — Allow both Primary and Secondary Production IPs
Avoid hardcoding IPs — Hardcoding IPs in the hosts file prevents automatic IDC center failover