Reaching the loan ledger behind สินเชื่ออีซี่'s OTP login

The number that matters in สินเชื่ออีซี่ is a moving one. Interest accrues daily on whatever slice of a 5,000–50,000 baht credit line the borrower has actually drawn, so the payoff figure shifts day to day rather than sitting still in a field somewhere. That single behaviour shapes the whole integration: anyone who wants this app's data wants the live drawn balance, the schedule, and a payoff that ties out to the baht — not a stale snapshot. Picolink (Pico Link Company Limited, per the app's Play listing) runs the lender; the data we care about lives in its backend, behind a phone-and-OTP login.

What sits inside an Easy Loan account

The Play description and the in-app screens give a clear picture of the surfaces. Each maps to a record an integrator would want to read on a schedule.

Authorized ways to reach the data

Three routes genuinely apply to this app. They differ in what they reach and how long they hold up.

1 · Consent-backed interface integration

A borrower who holds the account authorizes the work; we analyze the app's own traffic under that authorization and rebuild the calls — OTP exchange, session token, then the credit-line and schedule reads. This reaches everything the borrower can see in the app, which is the full ledger. It is the route we would recommend here, because the loan state lives only in Picolink's backend and the app is the one place it surfaces. Access to a consenting account is arranged with you during onboarding; we run the build against that account or a sponsor-provided test profile.

2 · Bank-side reconciliation via dStatement

Money in at disbursement and money out at repayment both land in a Thai bank account. dStatement, the bank-to-bank digital statement exchange the Bank of Thailand and the Thai Bankers' Association launched in January 2022, gives a machine-readable read of those legs with the customer's consent. It does not see the lender's internal schedule, but it confirms the cash actually moved.

3 · BOT "Your Data" consent rail (as it comes online)

The central bank's "Your Data" framework, whose formal regulation the BOT says it enacted in November 2025, brings loan and payment data into a standardized, consent-based exchange on a phased timeline starting late 2026. Where Picolink participates, this becomes a durable national rail rather than a per-app integration. We design so that today's consent-backed build can hand over to it without a rewrite.

A look at the OTP-to-token call chain

Illustrative shapes, confirmed during the build rather than read from a published spec. The flow mirrors the app's own registration-then-query path.

# Step 1 — phone + OTP exchange -> session token (the app's login)
POST /api/v1/auth/otp/verify
  { "msisdn": "+66XXXXXXXXX", "otp": "######", "device_id": "<android-id>" }
-> 200 { "access_token": "<jwt>", "expires_in": 1800,
         "refresh_token": "<...>" }

# Step 2 — credit line + drawn balance for the borrower
GET /api/v1/credit/line
  Authorization: Bearer <access_token>
-> 200 { "approved_limit": 50000, "available": 32500, "drawn": 17500,
         "apr": 35.8, "currency": "THB", "status": "active" }

# Step 3 — repayment schedule (interest daily on the drawn portion)
GET /api/v1/credit/schedule?contract=<id>
-> 200 { "installments": [
           { "due": "2026-07-15", "principal": ..., "interest": ...,
             "payoff_today": 21495 } ],
         "repay_via": ["bank_transfer","qr","barcode"] }

# 401 -> refresh token, retry once with backoff; never re-prompt OTP mid-sync

The payoff_today: 21495 is not arbitrary — it is the listing's own worked example, a 20,000 baht draw at 30% over 91 days. Reproducing that figure exactly is how we prove the read is correct.

What lands at the end of the build

The deliverables are tied to the surfaces above, not a generic checklist:

• An OpenAPI/Swagger specification for the auth, credit-line, schedule and transaction calls as they behave for this app.
• A protocol and auth-flow report covering the OTP exchange, the bearer-token lifecycle and refresh, and the error paths.
• Runnable source for the key endpoints in Python or Node.js — login, credit-line read, schedule read, payoff reconstruction.
• Automated tests, including a fixture that asserts the 20,000 baht / 91-day case resolves to 21,495 baht.
• Interface documentation and data-retention guidance written against Thai PDPA duties.

PDPA, the pico licence, and consented access

สินเชื่ออีซี่'s own Play listing states it operates under the Fiscal Policy Office (FPO) of the Ministry of Finance and protects personal data under Thailand's PDPA. Its 50,000 baht ceiling and "not more than 35.8% per year" rate place it inside the country's pico-finance / personal-loan rules, where total interest and fees are capped near a 36% effective annual rate. None of that is what we rely on to reach the data, though. The dependable basis is the borrower's own consent: the person who holds the account authorizes the pull, we take only the fields a given job needs, and consent is logged with an expiry and a revocation path. For the bank legs, the two Thai consent rails worth naming are dStatement (live since January 2022) and the BOT's "Your Data" framework (regulation enacted November 2025, per the central bank, phased from late 2026). We build to those as they come online and to PDPA's data-minimization duty in the meantime. NDAs are signed where a client needs them.

Engineering details we plan around

Two things about this app shape how we build, and we handle both inside the project:

• Session lifecycle. The login is OTP-gated and the token is short-lived. We design the sync around the token's expiry and refresh so it holds a valid session and pulls on schedule without re-prompting the borrower for an OTP on every run.
• Daily-accrual payoff. Because interest runs daily on the drawn balance, a naive "balance" field can disagree with the true payoff. We reproduce the lender's day-count — principal × APR ÷ 365 × days + principal — so our number matches the app's to the baht, and we cap it at the stated 35.8% per-year rate.
• Locale normalization. Amounts and dates can arrive in Thai locale and Buddhist-era formats on some screens; we normalize to ISO dates and integer satang so downstream systems see one consistent shape.

When Picolink ships a new app version — and these lenders re-version often — we watch the response shapes and refresh the field mappings rather than letting the sync drift. That monitoring is part of maintenance, not a separate scramble.

Where integrators put this data to work

• A lending marketplace verifying a borrower's current สินเชื่ออีซี่ exposure before extending its own offer.
• A personal-finance app showing a unified view of drawn balance and the next due date alongside other accounts.
• A collections or reminder service reading the schedule to nudge a borrower before a payoff date slips.
• An accounting tool reconciling the disbursement-in and repayment-out events against the borrower's bank statement.

Pricing and how a build runs

A working สินเชื่ออีซี่ integration comes back in one to two weeks, delivered against the OTP-token call chain shown above. Source-code delivery starts at $300: you receive the runnable API source and the interface docs, and you pay only after delivery, once the integration works for you. Prefer not to host it? Run it as a hosted API instead — you call our endpoints and pay per request, with no upfront fee. Tell us the app and what you want out of its data, and we handle access, the build and the compliance posture from there. Start a สินเชื่ออีซี่ integration.

Screens we mapped

The in-app screens the brief draws on. Tap to enlarge.

How this brief was put together

Checked in June 2026 against the app's Google Play listing and its stated product terms, the Bank of Thailand's open-data and dStatement pages, and a legal summary of Thailand's pico-finance licensing. The loan amounts, the 35.8% rate, the 91–180 day terms and the worked payoff example are taken from the listing; the data-sharing timelines are the BOT's own.

• สินเชื่ออีซี่ on Google Play
• Bank of Thailand — Open Data / "Your Data"
• Bank of Thailand — dStatement
• What is a pico-finance licence (Thailand)

Mapped by the OpenBanking Studio integration desk, June 2026.

Other Thai lending apps in the same picture

Same category, same integration shape — a unified loan view usually pulls several of these together. Named for context, not ranked.

• EASY สินเชื่อ — a sibling pico-finance app on the same ID-card model, holding loan accounts and repayment schedules.
• FINNIX — MONIX's revolving credit-line app, holding drawn balances and installment data for digital microloans.
• LINE BK — social-banking service inside LINE with deposit, transfer and credit-line records.
• PROMISE — personal-loan app with per-borrower application status and repayment ledgers.
• KTC — credit-card and personal-loan accounts carrying statement, limit and payment data.
• Rabbit Cash — personal-loan app holding income-based limits and repayment schedules.
• MoneyThunder — cash-loan app with per-borrower limit and installment records.
• Kashjoy — cash-card service holding approved limits and interest terms.

Questions integrators ask about สินเชื่ออีซี่

Where does สินเชื่ออีซี่ keep the repayment schedule, and can you read the payoff amount?

The schedule sits behind the app's OTP-gated loan account. We read the installment list, due dates and the day-by-day payoff, and we reconstruct the lender's day-count so the figure matches the app — the listing's own worked example resolves a 20,000 baht draw at 91 days to 21,495 baht.

Does this depend on the Bank of Thailand 'Your Data' framework being live first?

No. The dependable basis is the borrower's own consent against the account they already hold. BOT's Your Data programme, which the central bank says brings loan data into a phased rollout from late 2026, becomes a useful bank-side leg as it comes online — not a precondition.

How do you keep the interest figure correct when it accrues daily on the drawn balance?

We reproduce the published method — principal × APR ÷ 365 × days, capped at the 35.8% per-year rate the app states — and reconcile it against the schedule the account returns, so a drawn-balance read never disagrees with the true cost.

Picolink re-versions the app frequently. Does that break the integration?

Front-end churn is expected here. We monitor the response shapes the app returns and refresh the field mappings when a release changes them, so the sync keeps resolving rather than failing quietly.