What is PG Service?

PG (Payment Gateway) is a payment intermediary service that securely relays online payments.

To accept payments online, you would normally need to sign individual contracts with each payment institution — card issuers, banks, telecom companies, and so on — and develop each integration separately.
By integrating with Hecto Financial PG, you can access all payment methods with a single contract and a single integration.

Category	Direct Integration	Hecto Financial PG Integration
Contract	Separate contracts required with each card company, bank, and telecom provider	Full access with a single Hecto Financial contract
Development	Different API integrations for each payment institution	One-time integration with a unified SDK/API
Security	Must obtain each security certification independently	PG provider holds PCI-DSS certification and manages security processing
Settlement	Separate settlement per payment institution	Consolidated settlement
Maintenance	Must respond directly to policy changes from each institution	PG provider handles changes, minimizing merchant impact
Result Notification	Different result delivery methods per institution	Unified result delivery to notiUrl immediately after payment completion
Supported Payment Methods	Separate integration per institution	Credit cards, bank transfers, virtual accounts, mobile payments, gift cards, simple payments

Multiple Integration Methods Supported

Hecto Financial PG offers a variety of integration methods to meet the needs of each merchant.

Standard Payment (Checkout)Checkout ✓API ✗

The most common payment method where a hosted checkout appears when the customer clicks the pay button, allowing them to select a payment method and complete the payment. Used for most online payments such as shopping malls and reservation services.

Hecto Financial provides the checkout UI, so merchants do not need to build their own checkout.
Checkout launches when you call the JavaScript SDK (SETTLE_PG.pay).
Supports all payment methods including credit cards, bank transfers, virtual accounts, and mobile payments.

NOTE

If you are unsure which payment product to choose, we recommend integrating Standard Payment (Checkout) first. It is the fastest to integrate and supports most payment methods.

Understanding the Payment Flow

Online payments are broadly divided into two stages: Authentication and Authorization.

Authentication and Authorization

Stage	Description	Handled By
Authentication	The process of verifying that the person requesting payment is the legitimate cardholder	Card issuer app, certificate, password, etc.
Authorization	The process of actually processing the authenticated payment (generating a sale)	Issuer (card company, bank, etc.)

Once authentication is complete, authorization proceeds automatically. When authorization is complete, the actual sale is generated.

Checkout Integration Flow

This is the most common payment method. Payments are processed through the checkout provided by Hecto Financial.
Detailed flows can be found in each payment method section.

Buyer

Merchant

Hecto Financial

Issuer

11. Click pay on order page

1. Click pay on order page

22. Open checkout

2. Open checkout

33. Display checkout (select payment method)

3. Display checkout (select payment method)

44. Enter payment info & authenticate

4. Enter payment info & authenticate

55. Request authorization

5. Request authorization

66. Return authorization result

6. Return authorization result

77. Notify result (notiUrl POST)

7. Notify result (notiUrl POST)

88. Notify payment result

8. Notify payment result

Integration Steps

PG service integration proceeds in the following order.

Step 1. Contract and Review

Sign a PG service agreement with Hecto Financial and complete the issuer review for the payment methods you wish to use.

Contact a Hecto Financial sales representative to proceed with the contract.
Submit your business registration certificate, service URL, business plan, and other required documents.
After the contract is finalized, your Merchant ID (mchtId) and encryption key will be issued.

Step 2. Development in the Sandbox Environment

Develop and test your payment integration in the sandbox (testbed). You can start development immediately without waiting for the review to be completed.

Category	Sandbox / Test Environment	Production Environment
Checkout URL	`https://tbnpg.settlebank.co.kr`	`https://npg.settlebank.co.kr`
API URL	`https://tbgw.settlebank.co.kr`	`https://gw.settlebank.co.kr`
Merchant ID	Use test ID (e.g., `nxca_jt_il`)	Production ID issued at contract signing
Encryption	Use test key (plaintext allowed)	Use production key (encryption required)
Actual Payment	Does not occur	Actual sales generated

Step 3. Integration Validation

Once development is complete, request integration validation from Hecto Financial.

Verify that key scenarios such as payment, cancellation, and refund operate correctly.
Review that security logic such as hash verification and amount verification is correctly implemented.
Any issues found during validation must be fixed and re-validated.

Step 4. Go Live

Once both integration validation and issuer review are complete, switch to the production environment.

Replace the test URL with the production URL.
Replace the test key with the production key.
Perform a final test with a small amount in the production environment.

Any charges incurred during testing in the production environment are the merchant's responsibility. After going live, always test with a small amount first, and immediately cancel any test payments.

Encryption Specifications

Transaction data is protected using two encryption methods. In the production environment, transactions without encryption will be rejected.

Category	AES-256 (Encryption)	SHA-256 (Integrity Verification)
Purpose	Protecting sensitive data (amounts, customer information, etc.)	Preventing data tampering
Algorithm	AES-256 / ECB / PKCS5Padding	SHA-256

Amount verification is mandatory. Verification logic is required to prevent payment forgery caused by client-side amount manipulation.

Precautions

Any charges incurred during testing in the production environment are the merchant's responsibility. Always test in the sandbox (testbed).
Use only the POST method for requests.
Avoid using special characters in request parameters. Such as :, &, ?, ', ", <, >, etc.
Avoid using iframes when integrating checkout. It may not work correctly on some browsers or devices.
IE browser support has ended. Please use the Edge browser.
HTTPS is recommended for nextUrl, notiUrl, and cancUrl.
All communications use HTTPS (TCP/443), and TLS 1.2 or higher is recommended.
The system is configured with redundant IDC centers. DNS Lookup-based connections are recommended.