Integration Preparation

This guide covers the prerequisites and essential information you need before starting your Prepaid (SecurePay Prepaid) integration.

Environment Keys

The Sandbox and Production environments are separate, each using a distinct Merchant ID.

Environment	Merchant ID	Purpose
Sandbox	Shared test Merchant ID	Development and testing
Production	Merchant-specific Merchant ID	Live service

Merchant Key Provisioning (Post-Contract)

After signing a contract with Hecto Financial, you will receive the following credentials for the Production environment.

Item	Description
Merchant ID (mId)	Unique merchant identifier
AES Encryption Key	Key for encrypting and decrypting personal and sensitive data (32 bytes)
SHA-256 Hash Key	Key for generating tamper-prevention hashes

NOTE

Key Provisioning

The shared Sandbox keys and your merchant-specific Production keys are delivered separately at the time of service onboarding.

Server Integration Environment

Server Addresses and Network Information

SecurePay Prepaid has two server types: a UI server and an API server.

UI (MNG)

Used for member registration and My Information pages.

Environment	Domain	IP Address	Protocol
Sandbox	tb-mps.hectofinancial.co.kr	61.252.169.99	HTTPS(TCP/443)
Production	mps.hectofinancial.co.kr	14.34.14.47 (Main) 61.252.169.103 (DR)	HTTPS(TCP/443)

API

Used for API calls such as balance inquiry, spend, top-up, and withdrawal.

Environment	Domain	IP Address	Protocol
Sandbox	tb-mps-api.hectofinancial.co.kr	61.252.169.100	HTTPS(TCP/443)
Production	mps-api.hectofinancial.co.kr	14.34.14.48 (Main) 61.252.169.104 (DR)	HTTPS(TCP/443)

NOTE

Dual IDC Configuration

• The Hecto Financial SecurePay Prepaid system is configured with a primary center (Main) and a disaster recovery center (DR). • In the event of a Main center failure, traffic automatically switches to DR. Allow both the Main and DR IPs in your Production firewall rules. • DNS Lookup connections are recommended — center failover is handled automatically.

TLS Version

TLS 1.2 or higher is strongly recommended. Support for TLS 1.1 and below may be discontinued without prior notice in accordance with security guidelines.

Development Environment Requirements

SecurePay Prepaid uses both UI integration and API integration.

Type	Role
Frontend	UI page integration for member registration and My Information
Backend (required)	API calls for balance inquiry, spend, top-up, and withdrawal

NOTE

Mixed UI + API Integration

• UI integration: Member registration and My Information pages use Hecto Financial-provided screens. • API integration: Prepaid balance spend, top-up, and withdrawal are called from the merchant backend.

API Integration Details

The SecurePay Prepaid API is a JSON-based REST API.

Item	Value
Encoding	UTF-8
Method	POST
Data Format	application/json; charset=UTF-8
Protocol	HTTPS (TLS 1.2 or higher)

Security and Encryption

SecurePay Prepaid uses AES encryption and SHA-256 hashing to protect personal data.

AES Encryption (Personal Data)

Item	Value
Algorithm	AES-256/ECB/PKCS5Padding
Encoding	Base64 Encoding
Target Fields	CI value, transaction amount, customer name, mobile number, date of birth, PIN, etc.

Encryption Example:

Item	Value
Encryption Key	`SETTLEBANKISGOODSETTLEBANKISGOOD` (32 bytes)
Plaintext	`1234567890abcdef`
Encrypted Value	`ojTD5p0w4oi2UgEozPuKoZa98R6rydxUF4PH0EikbVo=`

Do Not Encrypt Empty Strings

Encrypting a blank or empty string will result in an A-001 error.

SHA-256 Hash (Tamper Prevention)

Item	Value
Algorithm	SHA-256
Encoding	Hex Encoding
Purpose	Generating pktHash (tamper detection for request data)

Hash Generation Example:

Item	Value
Hash Key	`ST7777777777777777777`
Plaintext	`20241024 + TEST + ST7777777777777777777` (reqDt + data + HashKey)
Hash Value	`2f3e6b50773293a4ca25957a27a85dfc7a5f4b245c526e2fee657ce64770c85b`

Integration Methods

SecurePay Prepaid uses both UI integration and API integration together.

Type	Description	Purpose
UI Integration	Uses Hecto Financial-provided screens	Member registration, My Information management
API Integration	Direct API calls from the merchant server	Balance inquiry, spend, top-up, withdrawal

NOTE

Detailed Integration Process

For a detailed step-by-step flow from member registration to API usage, refer to the Full Integration Flow document.

Important Notes

Test Environment

Test Hours: Be aware that between 1:00 PM and 2:00 PM on business days, test server deployments may occur.
Test Keys: The Sandbox uses shared keys; the Production environment uses merchant-specific keys.

API Request Notes

Use the POST method (UI uses GET)
UTF-8 encoding is required
Content-Type: application/json; charset=UTF-8
Personal data fields must be AES-256 encrypted
The pktHash field must be generated using SHA-256

CI Value Encryption

The CI value must be AES-256 encrypted when calling the member registration or My Information page
The encrypted CI value must be URI-encoded
The CI value must match what was entered during identity verification