HanaPay data API for cards, QR and bills
하나Pay(하나카드) is Hana Card's official Android app for South Korean cardholders — the consumer face of 하나카드, the credit-card arm of Hana Financial Group. After a PIN, fingerprint (FIDO) or OneSign face login, the home shows card value, remaining limit and this month's benefits in one glance; QR and barcode pay can skip a second PIN, a home-screen widget or a shake gesture opens the till code without launching the full UI, and the same session checks a linked Hana Bank account and sends a remittance. Offline MST and HCE cover Samsung Pay and Android tap, overseas Visa / Mastercard / UnionPay QR sit next to ZeroPay and T-money, and Hana Members points, MyData asset linking, app-card design and a chatbot round out the product. Published for Korea only, it holds a 4.7 rating across 274K Google Play reviews and 10 million-plus installs, and it competes with Shinhan pLay, KB Pay, Samsung Card and Hyundai Card for the same domestic card wallet.
Signed-in wallets in CRD_LIST pin CRD_NO_HASH next to usable points U_PSB_PT and a virtual account VT_ACNO. The home widget then stamps the estimated statement as EST_PAY_AMOUNT on EST_PAY_DT, while the open-banking hop returns won cash as AC_BAL_AMT.
QR decode yields payee ACCTID, AMOUNT and merchant NAME; HCE and MST mint ENCRYPTED_TOKEN plus TRACK2_DATA for tap. Overseas rows carry APRNO / WC_APR_AM, UnionPay cards flag upi_token_yn, and Hana Members SSO hands back oAuthKey with PTR_POINT. Treasury, POS and loyalty stacks use those fields; openData Studio turns them into callable open data.
Screenshots
API surface
The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.
Issac public-key bootstrap
POST
/v1/hanapay/device/keysopendataHands the app the HANACARDMOBILE device certificate and Issac PUBLIC_KEY used to wrap PIN, FIDO and nFilter payloads on every later call.
Auth: None. First call of a cold start; the returned HANACARDMOBILE cert and PUBLIC_KEY encrypt later PIN and FIDO payloads.
- OS_DV_C
- APP_VER
- DVC
- HANACARDMOBILE
- PUBLIC_KEY
POST /v1/hanapay/device/keys HTTP/1.1 Content-Type: application/json { "OS_DV_C": "A", "APP_VER": "7.7.4", "DVC": "and-hana-8f21" }{ "HANACARDMOBILE": "-----BEGIN CERTIFICATE-----\nMIIB...hana\n-----END CERTIFICATE-----", "PUBLIC_KEY": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..." }Cardholder login session
POST
/v1/hanapay/sessionsosintOpens the signed-in cardholder: masked name and phone, encrypted member and card numbers, MyData customer sequence, and the feature flags that unlock QR, HCE, UnionPay, open-banking and Hana Money.
Auth: Issac-wrapped AUTH_PW (PIN) or FIDO assertion using the PUBLIC_KEY from the device-key bootstrap call. Later calls send the issued session plus ENC_MBR_ID.
- CST_NM
- CELL_NO
- MBR_ID
- ENC_MBR_ID
- ENC_CNO
- ITG_CNO
- EWLT_CNO
- SEX_DC
- JOIN_DC
- LGN_ST_DV_C
- CST_ST_DV_C
- CRD_LIST
- MYDATA_CST_SEQ
- MYDATA_SYNC_YN
- HANAMONEY_USE_YN
- QR_USE_YN
- HCE_USE_YN
- NFC_PAY_YN
- GTS_UPI_SERVICE_USE_YN
- OB_BN_USE_YN
- AUTH_AUTO_LOGIN_YN
- RES_PAY_TOKEN
- NFILTER_PUBLICKEY
- FIDO_URL
- SERVER_DATE
- SERVER_TIME
POST /v1/hanapay/sessions HTTP/1.1 Content-Type: application/json { "OS_DV_C": "A", "APP_VER": "7.7.4", "AUTH_PW": "nfilter_enc_pin", "FIDO_CTF_US_YN": "Y" }{ "CST_NM": "김하나", "CELL_NO": "01012345678", "MBR_ID": "hana_mbr_8841", "ENC_MBR_ID": "enc_mbr_9f21", "ENC_CNO": "enc_cno_4419", "ITG_CNO": "itg_cno_1204", "EWLT_CNO": "ewlt_8821", "SEX_DC": "M", "JOIN_DC": "20180312", "LGN_ST_DV_C": "1", "CST_ST_DV_C": "00", "CRD_LIST": "[{\"CRD_NM\":\"하나 CLUB SK\",\"CRD_NO_HASH\":\"crd_hash_77a\",\"CRD_MASK_NO\":\"5388-****-****-1234\"}]", "MYDATA_CST_SEQ": "md_seq_3310", "MYDATA_SYNC_YN": "Y", "HANAMONEY_USE_YN": "Y", "QR_USE_YN": "Y", "HCE_USE_YN": "Y", "NFC_PAY_YN": "Y", "GTS_UPI_SERVICE_USE_YN": "Y", "OB_BN_USE_YN": "Y", "AUTH_AUTO_LOGIN_YN": "Y", "RES_PAY_TOKEN": "rpt_hana_7c21", "NFILTER_PUBLICKEY": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...", "FIDO_URL": "https://fido.example.com", "SERVER_DATE": "20261020", "SERVER_TIME": "104512" }Registered card wallet
POST
/v1/hanapay/wallet/cardsopenfinanceLists every plastic and app-card in the wallet — hashed PAN, brand, usable points, virtual account and whether limit or open-banking balance inquiry is on.
Auth: Session from the login call plus ENC_MBR_ID.
- ALL_CRD_CNT
- REG_CRD_CNT
- SEL_CRD_CNT
- CRD_LIST
- CRD_ID
- CRD_NM
- CRD_NO
- CRD_NO_HASH
- CRD_MASK_NO
- CRD_CD
- CRD_TP
- CRD_OFR_FC
- CD_ST_C
- CARD_LAST
- U_PSB_PT
- VT_ACNO
- OB_ACNT_WIRE_LINK
- LIM_INQ_YN
- AC_BAL_INQ_YN
- MST_USE_YN
- MOBILE_CARD_YN
- CRD_IMG_URL
- ACC_CRD_LIST
- AGNC_CRD_LIST
POST /v1/hanapay/wallet/cards HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "OS_DV_C": "A" }{ "ALL_CRD_CNT": "3", "REG_CRD_CNT": "2", "SEL_CRD_CNT": "1", "CRD_LIST": [ { "CRD_ID": "crd_1204", "CRD_NM": "하나 CLUB SK", "CRD_NO": "538812******1234", "CRD_NO_HASH": "crd_hash_77a", "CRD_MASK_NO": "5388-****-****-1234", "CRD_CD": "HC01", "CRD_TP": "C", "CRD_OFR_FC": "VISA", "CD_ST_C": "00", "CARD_LAST": "1234", "U_PSB_PT": "18420", "VT_ACNO": "110123456789", "OB_ACNT_WIRE_LINK": "oneqpay://account", "LIM_INQ_YN": "Y", "AC_BAL_INQ_YN": "Y", "MST_USE_YN": "Y", "MOBILE_CARD_YN": "Y", "CRD_IMG_URL": "https://cdn.example.com/cards/hc01.png" } ], "ACC_CRD_LIST": [], "AGNC_CRD_LIST": [] }Home-widget statement snapshot
POST
/v1/hanapay/widgets/statementopenbankingReturns the estimated statement amount and due date the home-screen widget paints, plus a compact CRD_LIST and last-update timestamp.
Auth: Session from the login call. Also called from the 2x2 / 4x1 / 4x2 home-screen widgets without opening the main app.
- EST_PAY_AMOUNT
- EST_PAY_DT
- CRD_LIST
- LGN_ST_DV_C
- CST_ST_DV_C
- JOIN_DC
- MEM_YN
- STP_YN
- ATP_MBG_MBYN
- UD_DTTI
POST /v1/hanapay/widgets/statement HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "OS_DV_C": "A" }{ "EST_PAY_AMOUNT": "428000", "EST_PAY_DT": "20261115", "CRD_LIST": "[{\"CRD_NM\":\"하나 CLUB SK\",\"CRD_NO_HASH\":\"crd_hash_77a\"}]", "LGN_ST_DV_C": "1", "CST_ST_DV_C": "00", "JOIN_DC": "20180312", "MEM_YN": "Y", "STP_YN": "N", "ATP_MBG_MBYN": "Y", "UD_DTTI": "20261020104512" }Linked-account open-banking balance
POST
/v1/hanapay/accounts/balanceopenbankingReads the won balance on the Hana Bank (or other open-banking) account wired to the card, plus the deep-link URL the app uses to jump into mobile banking.
Auth: Session from the login call. Requires OB_BN_USE_YN=Y on the login payload.
- VT_ACNO
- INQ_DC
- AC_BAL_AMT
- TERM_YN
- OB_AC_URL
- OB_AC_POPUP_USE_YN
- OB_AC_POPUP_CONTS
POST /v1/hanapay/accounts/balance HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "VT_ACNO": "110123456789", "INQ_DC": "1" }{ "AC_BAL_AMT": "2534100", "INQ_DC": "1", "TERM_YN": "Y", "OB_AC_URL": "https://bank.example.com/app", "OB_AC_POPUP_USE_YN": "N", "OB_AC_POPUP_CONTS": "" }QR payment decode
POST
/v1/hanapay/payments/qr/decodeopenbankingTurns a scanned KR QR (ZeroPay / GLN / merchant) into payee account, won amount, merchant phone, display name and pay date.
Auth: Session from the login call. Fed by the in-app camera scanner for merchant, ZeroPay and GLN QR codes.
- QR_RAW
- CRD_NO_HASH
- ACCTID
- AMOUNT
- HPNO
- NAME
- PDATE
POST /v1/hanapay/payments/qr/decode HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "CRD_NO_HASH": "crd_hash_77a", "QR_RAW": "00020101021228...hana" }{ "ACCTID": "110987654321", "AMOUNT": "15800", "HPNO": "01098765432", "NAME": "카페하나", "PDATE": "20261020" }Contactless HCE payment token
POST
/v1/hanapay/payments/tap/tokenopenbankingMints a time-boxed HCE token (encrypted + signed) and Track2 for Android tap-to-pay, with CA chain and optional won approval amount.
Auth: Session from the login call plus PIN/FIDO. Served by the dedicated tap-to-pay (HCE) token service.
- CRD_NO_HASH
- AUTH_PW
- TP
- CODE
- MSG
- MC_NM
- WC_APR_AM
- DURATION_TIME
- ENCRYPTED_TOKEN
- SIGNED_TOKEN
- TRACK2_DATA
- END_ENTITY_CA
- INTERMEDIATE_CA
POST /v1/hanapay/payments/tap/token HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "CRD_NO_HASH": "crd_hash_77a", "AUTH_PW": "nfilter_enc_pin", "TP": "HCE" }{ "CODE": "0000", "MSG": "OK", "TP": "HCE", "MC_NM": "", "WC_APR_AM": "0", "DURATION_TIME": "90", "ENCRYPTED_TOKEN": "enc_tok_hana_c4e1", "SIGNED_TOKEN": "sig_tok_hana_91ab", "TRACK2_DATA": "5388120012341234D2512", "END_ENTITY_CA": "hana_ee_ca", "INTERMEDIATE_CA": "hana_int_ca" }Offline MST/NFC payment token
POST
/v1/hanapay/payments/offline/tokenopenbankingIssues the MST magnetic-stripe or NFC token Samsung Pay / offline barcode screens pulse, with a duration and Track2 equivalent.
Auth: Session from the login call. Used by the offline barcode / MST screen and the Samsung Pay integration.
- CRD_NO_HASH
- DVC
- AUTH_YN
- DURATION_TIME
- ENCRYPTED_TOKEN
- SIGNED_TOKEN
- TRACK2_DATA
- END_ENTITY_CA
- INTERMEDIATE_CA
POST /v1/hanapay/payments/offline/token HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "CRD_NO_HASH": "crd_hash_77a", "DVC": "MST" }{ "AUTH_YN": "Y", "DURATION_TIME": "60", "DVC": "MST", "ENCRYPTED_TOKEN": "enc_mst_hana_22b", "SIGNED_TOKEN": "sig_mst_hana_88c", "TRACK2_DATA": "5388120012341234D2512", "END_ENTITY_CA": "hana_ee_ca", "INTERMEDIATE_CA": "hana_int_ca" }Membership points wallet
POST
/v1/hanapay/membership/pointsopendataReturns the Hana Members (and alliance) point tally PTR_POINT plus each membership card's number, usable flag and artwork.
Auth: Session from the login call.
- EWLT_CNO
- PTR_POINT
- CRD_LIST
- ms_cd_nm
- ms_cdno
- ms_point
- ms_us_yn
- ms_cd_img_ph_nm
POST /v1/hanapay/membership/points HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "EWLT_CNO": "ewlt_8821" }{ "PTR_POINT": "18420", "CRD_LIST": [ { "ms_cd_nm": "하나멤버스", "ms_cdno": "8800-****-****-2211", "ms_point": "18420", "ms_us_yn": "Y", "ewlt_cno": "ewlt_8821", "ms_cd_img_ph_nm": "https://cdn.example.com/cards/hm.png" } ] }Overseas approval feed
POST
/v1/hanapay/overseas/approvalsopenbankingPages overseas authorizations with approval number, merchant, won amount, foreign amount and cancel amount.
Auth: Session from the login call. Backs the overseas approval list and pay-history screens.
- CRD_NO_HASH
- SDT
- EDT
- approvalList
- APRNO
- APR_STC
- APR_SYS_PC_DT
- APR_SYS_PC_TI
- APR_SYS_PC_DTTI
- MC_NM
- WC_APR_AM
- BY_AM
- BY_CAN_AM
POST /v1/hanapay/overseas/approvals HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "CRD_NO_HASH": "crd_hash_77a", "SDT": "20260901", "EDT": "20261020" }{ "approvalList": [ { "APRNO": "APR-882199", "APR_STC": "00", "APR_SYS_PC_DT": "20261018", "APR_SYS_PC_TI": "214433", "APR_SYS_PC_DTTI": "20261018214433", "MC_NM": "TOKYO STORE", "WC_APR_AM": "128000", "BY_AM": "12800", "BY_CAN_AM": "0" } ] }Overseas UnionPay card list
POST
/v1/hanapay/overseas/unionpay/cardsopenfinanceLists cards provisioned for overseas UnionPay QR (GTS UPI) with hashed PAN, product name and whether a UnionPay token already exists.
Auth: Session from the login call. GTS_UPI_SERVICE_USE_YN must be Y.
- code
- msg
- tp
- card_list_cnt
- cst_nm
- crd_cd
- crd_nm
- crd_no
- crd_no_hash
- crd_ofr_fc
- cd_st_c
- img_ph_nm
- mu_cd_yn
- upi_token_yn
POST /v1/hanapay/overseas/unionpay/cards HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21" }{ "code": "0000", "msg": "OK", "tp": "UPI", "card_list_cnt": "1", "cst_nm": "KIM HANA", "crd_cd": "HC01", "crd_nm": "Hana CLUB SK", "crd_no": "538812******1234", "crd_no_hash": "crd_hash_77a", "crd_ofr_fc": "UPI", "cd_st_c": "00", "img_ph_nm": "https://cdn.example.com/cards/hc01.png", "mu_cd_yn": "N", "upi_token_yn": "Y" }Overseas-mode enrollment check
POST
/v1/hanapay/overseas/enrollmentopenfinanceChecks whether the device is enrolled in overseas pay and whether Visa / Mastercard tokens are already registered, returning the eligible card list.
Auth: Session from the login call.
- deviceId
- tp
- agYn
- cardCnt
- visaRegCheck
- masterRegCheck
- cardListArray
POST /v1/hanapay/overseas/enrollment HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21", "deviceId": "and-hana-8f21" }{ "tp": "GTS", "agYn": "Y", "cardCnt": "2", "deviceId": "and-hana-8f21", "visaRegCheck": "Y", "masterRegCheck": "Y", "cardListArray": "[{\"crd_nm\":\"Hana CLUB SK\",\"crd_no_hash\":\"crd_hash_77a\"}]" }OpenPay issuer directory
POST
/v1/hanapay/issuersopendataLists third-party card issuers the OpenPay / 타사카드 flow can add — name, auth type, whether a card is already in-app and whether a signature is registered.
Auth: Session from the login call. Used by the add-another-issuer (OpenPay) card flows.
- CODE
- MSG
- TP
- PRV_AG_YN
- CDCO_LIST
- CDCO_NM
- CDCO_DC
- CDCO_AUTH_DC
- CDCO_IMG_URL
- CRD_IN_CA
- SIGN_REG_YN
POST /v1/hanapay/issuers HTTP/1.1 Content-Type: application/json { "ENC_MBR_ID": "enc_mbr_9f21" }{ "CODE": "0000", "MSG": "OK", "TP": "OP", "PRV_AG_YN": "Y", "CDCO_LIST": [ { "CDCO_NM": "신한카드", "CDCO_DC": "SH", "CDCO_AUTH_DC": "01", "CDCO_IMG_URL": "https://cdn.example.com/issuers/sh.png", "CRD_IN_CA": "Y", "PRV_AG_YN": "Y", "SIGN_REG_YN": "N" } ] }Hana Members SSO
POST
/v1/hanapay/membership/ssoosintExchanges the cardholder into Hana Members: oAuthKey, member customer number, email local-part/domain, account-stop flag and PIN-use flag.
Auth: Hana Card session plus the E2E key issued by the Hana Members init call.
- mebCstNo
- encParam
- oAuthKey
- emlId
- emlDmn
- cstStC
- accStopYn
- cddYn
- reArYn
- usePin
- pswdErrCotiTms
POST /v1/hanapay/membership/sso HTTP/1.1 Content-Type: application/json { "mebCstNo": "hana_mbr_8841", "encParam": "issac_e2e_blob" }{ "oAuthKey": "oauth_hm_7c21", "mebCstNo": "hana_mbr_8841", "emlId": "hana", "emlDmn": "hanamail.net", "cstStC": "00", "accStopYn": "N", "cddYn": "N", "reArYn": "N", "usePin": "Y", "pswdErrCotiTms": "0" }
Data categories
- cards
- balances
- payments
- statements
- membership-points
- identity
- open-banking
Where teams use this data
Card-wallet reconciliation
A bookkeeping bot pulls CRD_LIST nightly, matches CRD_NO_HASH to the issuer file, and flags CD_ST_C or CRD_INACT_YN drifts plus U_PSB_PT point deltas.
Till and tap confirmation
A store app decodes a HanaPay QR into ACCTID / AMOUNT / NAME, then correlates the HCE or MST token's TRACK2_DATA and WC_APR_AM with the POS authorization.
Statement-due cash planning
A household-cashflow tool reads EST_PAY_AMOUNT and EST_PAY_DT from the widget snapshot and the linked-account AC_BAL_AMT so the due date is funded before 하나카드 drafts.
Members-point and MyData join
A loyalty stack joins PTR_POINT and ms_cdno to MYDATA_CST_SEQ / mebCstNo so Hana Members earn and the open-banking asset list sit on one customer key.
Frequently asked questions
How does HanaPay authenticate cardholders?
A cold-start call to POST /v1/hanapay/device/keys returns the HANACARDMOBILE cert and Issac PUBLIC_KEY, then POST /v1/hanapay/sessions takes an nFilter-wrapped PIN or FIDO assertion. Later calls send that session plus ENC_MBR_ID. Hana Members uses a second hop at POST /v1/hanapay/membership/sso that returns oAuthKey.
Which fields identify a card in the wallet?
POST /v1/hanapay/wallet/cards returns CRD_LIST rows with CRD_ID, CRD_NM, masked CRD_NO, CRD_NO_HASH, CRD_OFR_FC (Visa and so on), U_PSB_PT points, VT_ACNO and flags for limit inquiry, MST and mobile-card.
Can I read statement due date and a bank balance, not just cards?
Yes. The widget call POST /v1/hanapay/widgets/statement returns EST_PAY_AMOUNT and EST_PAY_DT. POST /v1/hanapay/accounts/balance returns AC_BAL_AMT for the open-banking account linked to the card, with OB_AC_URL into Hana Bank mobile.
What does a QR or tap payment return?
QR decode at POST /v1/hanapay/payments/qr/decode yields ACCTID, AMOUNT, HPNO, NAME and PDATE. HCE at POST /v1/hanapay/payments/tap/token and offline MST at POST /v1/hanapay/payments/offline/token mint ENCRYPTED_TOKEN, SIGNED_TOKEN, TRACK2_DATA and DURATION_TIME.
Apps similar to 하나Pay(하나카드)
- KB Pay — KB Pay is KB Kookmin Card's Android app for spend lookup, instant settlement, card issuance, paying with a registered card, bank account or PoinTree, and a mobile transit card on Korean buses and subways.
- 신한 SOL페이 — 신한 SOL페이 is Shinhan Card's payment platform for on-site and PC checkout, statements and per-card spend, points and coupons, and card suggestions from spending patterns, and it can be opened without holding a Shinhan Card.
- 현대카드 — The Hyundai Card app covers card applications, lookup and App Card payments at offline and overseas merchants without plastic, and shows accounts, insurance, cars and property in the same session.
- 모니모 — monimo is Samsung Card's unified Samsung finance app, combining Samsung Card statements with Samsung Life and Fire claims and Samsung Securities investing.
- 디지로카(롯데카드) — Digi Loca is Lotte Card's app for payment history, card benefits and events, plus loans, car finance, shopping coupons and travel booking.
- 우리카드 우리WON카드 — 우리WON카드 is Woori Card's app for expected payment amounts, credit limits, held cards and recent spend, plus card applications and short- or long-term card loans.
- NH pay(NH페이) — NH pay is Nonghyup Card's payment app: register an NH credit, debit or gift card or an NH bank account, then pay online or in-store with QR, barcode or NFC and check bills from other issuers.
- 카카오페이 — KakaoPay is a Korean payments app for barcode and QR checkout plus Samsung Pay and ZeroPay in stores, and the same session covers remittance, cards, accounts, insurance, loans and investing.
Topics
- hanapay api
- hana card api
- 하나페이
- 하나카드
- korean credit card api
- hanapay qr nfc
- hana members points
- open banking korea card
Need this app's data API integrated?
We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.
- NDA + SOW on every engagement
- Delivery in 3–7 days
- Payment only after acceptance
- Work scoped to authorized use