Before You Begin

This guide covers the preparation and basic information required before integrating the EZAuth Bank Transfer API.

Credentials by Environment

The sandbox and production environments are fully isolated and use separate merchant IDs and keys.

Environment	Merchant ID	Auth Key	Purpose
Sandbox	Shared test merchant ID	Shared test key	Development and testing (no actual payment occurs)
Production	Merchant-specific merchant ID	Merchant-specific key	Live service (actual payment occurs)

Merchant-Specific Key Issuance (After Contract)

After signing a contract with Hecto Financial, you will receive the following credentials for use in the production environment.

Item	Description
Merchant ID (mercntId)	Unique merchant identifier
Hash Key	Key used for signature generation
Encryption Key	Key for protecting transaction amounts and sensitive data (AES-256, 32 bytes)

Integration Script

To use the payment checkout, add the following script to your HTML. Select the script that matches your environment.

<!-- Sandbox -->
<script src="https://tbezauth.settlebank.co.kr/resources/js/SettlePay.js"></script>

<!-- Production -->
<script src="https://ezauth.settlebank.co.kr/resources/js/SettlePay.js"></script>

NOTE

Script Load Order

SettlePay.js must be loaded before the payment checkout is invoked. Insert it in <head> or before the payment trigger button.

Server Integration Environment

Server Addresses and Network Information

EZAuth Bank Transfer supports both a checkout (UI) method and a direct API method. After the customer completes authentication through the checkout, your server calls the payment capture API.

Checkout

Environment	Domain	IP Address	Protocol
Sandbox	tbezauth.settlebank.co.kr	211.236.228.36	HTTPS(TCP/443)
Production	ezauth.settlebank.co.kr	61.252.169.45	HTTPS(TCP/8081)

API

Environment	Domain	IP Address	Protocol
Sandbox	tbezauthapi.settlebank.co.kr	211.236.228.36	HTTPS(TCP/443)
Production	ezauthapi.settlebank.co.kr	61.252.169.45	HTTPS(TCP/8081)

NOTE

Production Port Number

The production environment uses port 8081. Configure your firewall to allow outbound HTTPS(TCP/8081).

Integration Prerequisites

EZAuth Bank Transfer integration requires both a frontend and a backend.

Layer	Role
Frontend (required)	Load SettlePay.js, invoke the payment checkout, receive authentication callback
Backend (required)	Generate SHA-256 hash, encrypt transaction amount, call payment capture API

Backend Required

Signature generation and amount encryption must be performed server-side for security. A frontend-only integration is not supported.

Encryption and Tamper Protection

EZAuth Bank Transfer uses two security mechanisms to protect data in transit.

Sensitive Data Encryption

Encrypts transaction amounts and other sensitive fields before transmission.

Item	Details
Algorithm	AES-256 / ECB / PKCS5Padding
Encoding	Hex encoding
Encrypted fields	Transaction amount (trPrice), cancellation amount, etc.
Key length	32 bytes
Sandbox key	SETTLEBANKISGOODSETTLEBANKISGOOD
Production key	Issued after contract signing

SHA-256 Signature (Tamper Protection)

Verifies data integrity to prevent request tampering.

Item	Details
Algorithm	SHA-256
Encoding	Hex encoding
Sandbox key	Provided after contract
Production key	Issued after contract signing
Generation method	Concatenate parameters → SHA-256 hash → Hex encode

Signature Verification Required

• Requests: A valid signature must be included (requests with mismatched signatures are rejected). • Responses: Always verify the integrity of parameters received in the callback before calling the capture API.

Important Notes

Production Environment Testing

Caution: Any transactions processed in the production environment will incur actual charges. Complete all testing in the sandbox before switching to production.

API Request Requirements

Only POST method is supported.
Use only parameters defined in the integration specification.
Special characters, HTML tags, and emoji are not permitted in field values.
ordNo must be unique within the same calendar day (00:00–24:00).

Frontend Integration Notes

Avoid embedding the checkout in an iframe — some browsers may malfunction.
Use HTTPS for callbackUrl.
callbackUrl domain must contain at least two dots (e.g., www.example.com).

Browser and Protocol Requirements

TLS 1.2 or higher required.
- HTTPS only (port 443 or 8081); HTTP is not supported.
Supported browsers: Chrome, Edge, Firefox, Safari.
Unsupported: Internet Explorer (end-of-life), Opera.