Before You Begin

This guide covers the preparation and basic information you need to know before starting PG API integration.

Key Information by Environment

The sandbox and production environments are separate and use different merchant IDs and keys. The sandbox uses shared test keys, while the production environment uses merchant-specific keys.

Environment	Merchant ID	Auth Key	Purpose
Sandbox	Shared test merchant ID	Shared test key	Development and testing (no actual payment occurs)
Production	Merchant-specific merchant ID	Merchant-specific key	Live service (actual payment occurs)

Merchant-Specific Key Issuance (After Contract)

After signing a contract with Hecto Financial, you will receive the following information for use in the production environment.

Item	Description
Merchant ID (mchtId)	Unique merchant identifier
License Key	Key for hash generation
Encryption Key	Key for protecting transaction amounts and personal information (AES-256)

Server Integration Environment

Server Address and Network Information

The Checkout method calls the checkout page via SDK or HTML Form, while the API method calls the API directly from the server in JSON format. The webhook server is a server that sends payment results from Hecto Financial to your server after a transaction is completed.

Checkout

Environment	Domain	IP Address	Protocol
Sandbox	tbnpg.settlebank.co.kr	61.252.169.51	HTTPS(TCP/443)
Production	npg.settlebank.co.kr	14.34.14.25 (Primary) 61.252.169.58 (Secondary)	HTTPS(TCP/443)

API

Environment	Domain	IP Address	Protocol
Sandbox	tbgw.settlebank.co.kr	61.252.169.42	HTTPS(TCP/443)
Production	gw.settlebank.co.kr	14.34.14.21 (Primary) 61.252.169.53 (Secondary)	HTTPS(TCP/443)

Webhook

Environment	IP Address	Protocol
Sandbox	61.252.169.22	HTTPS(TCP/443)
Production	14.34.14.23 (Primary) 61.252.169.24 (Secondary)	HTTPS(TCP/443)

NOTE

High Availability (Dual IDC)

• The Hecto Financial PG system is configured in dual data centers with a Primary and Secondary center. • In the event of a Primary center failure, automatic failover to the Secondary occurs, so both Primary and Secondary IPs for the production environment must be allowed through the firewall. • DNS Lookup connection is recommended — this is handled automatically during center failover (hosts file pinning will prevent failover)

Allow Webhook Server IPs in Your Firewall

All webhook server IPs must be allowed for Inbound access through your firewall. Both the Primary and Secondary IPs must be allowed; if either is missing, webhooks sent from that center may not be received.

Integration Prerequisites

PG integration requires both a frontend and a backend.

Component	Role
Backend (Required)	Hash generation, amount encryption, result verification
Frontend	Call the checkout page using encrypted data generated by the backend (SDK or HTML Form)

Server-Side Implementation Required

For security reasons, hash generation and amount encryption must be handled on the server. Payment integration is not possible with a frontend-only approach.

Encryption/Decryption and Request Signature (pktHash)

PG payments (including Checkout calls) use two types of security for data protection. Both the Checkout method and the API method apply the same security.

Personal and Sensitive Information Encryption/Decryption

This is the encryption method for protecting personal and sensitive information.

Item	Details
Algorithm	AES-256 / ECB / PKCS5Padding
Encoding	Base64 Encoding
Encryption Targets	Transaction amount, customer name, mobile number, email, card number, account number, etc.
Sandbox Key	pgSettle30y739r82jtd709yOfZ2yK5K
Production Key	Provided upon contract completion

Request Signature (pktHash)

This is the hash generation method for verifying data integrity.

Item	Details
Algorithm	SHA-256
Encoding	Hex Encoding
Sandbox Key	ST1009281328226982205
Production Key	Provided upon contract completion
Generation Method	Combine parameters → SHA-256 hash → Hex conversion

Always Verify the Response Signature

• Request: pktHash must be generated and included (request will be rejected on mismatch) • Response: Service should only be provided after verifying pktHash (failure to verify creates risk of tampering attacks)

Important Notes

Live Environment Testing

Warning: Any charges processed in the production environment — including test transactions — will result in real costs. Complete all testing in the sandbox environment before going live.

API Request Precautions

Use POST method only
Use only parameters specified in the integration specification
Do not use special characters, HTML tags, or emojis
mchtTrdNo duplicate check resets daily at midnight (KST, UTC+9). The same order number can be reused on subsequent calendar days.

Client-Side Notes

Avoid using iframes (may malfunction in some browsers)
HTTPS is recommended for notiUrl, nextUrl, and cancUrl
Database processing must be performed in notiUrl (nextUrl is for UI rendering only)

Browser and Protocol Requirements

TLS 1.2 or higher is required
- HTTPS (port 443) only; HTTP is not supported
- Ensures secure encrypted communication
Supported Browsers: Chrome, Edge, Firefox, Safari
Unsupported Browsers: Internet Explorer (end of support), Opera