Open Banking Gateway
Live available

Agent wallet · Bangladesh

bKash Agent API

bKash agent/merchant wallet (Bangladesh) — OTP login, balance, recent transactions, search, paged history, PDF statements, and agent→customer Cash-In transfer.

Try in sandboxGuided demo (English)
14 endpoints1 credit / successful live call

Sandbox · Request

curl · POST /login/request-otp
curl -X POST 'https://www.openbankinggateway.com/api/sandbox/bkash-agent/login/request-otp' \
  -H 'Content-Type: application/json' \
  --data '{
  "account": "01700000001",
  "phoneOperator": "Grameenphone"
}'

Illustrative sandbox example. No provider is contacted, no SMS is sent, no funds move, and no credits are charged.

API reference

Know what you can call.

Methods, paths, and parameter rules come from the same catalog that powers the console. Open an endpoint to see its request fields.

Wallet authentication

POST
/login/request-otp

Send the login OTP by SMS

Live available

/api/sandbox/bkash-agent/login/request-otp

POST login/request-otp · Parameter
ParameterTypeRules & handling
accountRequiredstring

JSON body

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
phoneOperatorRequiredstring

JSON body

Mobile operator of the agent SIM.

  • Allowed values: Grameenphone | RobiAirtel | Banglalink | Teletalk | Airtel
POST
/login/verify-otp

Verify the OTP and issue a session token

Live available

/api/sandbox/bkash-agent/login/verify-otp

POST login/verify-otp · Parameter
ParameterTypeRules & handling
accountRequiredstring

JSON body

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
pinRequiredstring

JSON body

Wallet PIN.

Sensitive · never put in URLs

  • Format: ^\d{4,8}$
otpRequiredstring

JSON body

Digits of the SMS OTP.

Sensitive · never put in URLs

  • Format: ^\d{4,8}$
otpHashRequiredstring

JSON body

The trailing hash string of the OTP SMS.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9+/=_-]{4,128}$

Account & activity

GET
/balance

Wallet balance, or a peek at a destination wallet

Live available

/api/sandbox/bkash-agent/balance

GET balance · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
msisdnOptionalstring

Query parameter

Wallet to peek at (with serviceName=CASH_IN).

  • Format: ^01\d{9}$
serviceNameOptionalstring

Query parameter

TAP_FOR_BALANCE (own wallet) or CASH_IN (destination peek).

  • Allowed values: TAP_FOR_BALANCE | CASH_IN
GET
/recent-transactions

Most recent transactions with full details

Live available

/api/sandbox/bkash-agent/recent-transactions

GET recent-transactions · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
pageSizeOptionalinteger

Query parameter

  • Range: 1 … 50
GET
/notification-history

Paged transaction feed (pageToken cursor)

Live available

/api/sandbox/bkash-agent/notification-history

GET notification-history · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
pageSizeOptionalinteger

Query parameter

  • Range: 1 … 50
pageTokenOptionalstring

Query parameter

Cursor from the previous page (omit for the first page).

  • Format: ^[!-~]{1,128}$
  • Length: 0 … 128
GET
/summary/daily

Daily transaction summary by type

Live available

/api/sandbox/bkash-agent/summary/daily

GET summary/daily · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
GET
/summary/monthly

Monthly transaction summary

Live available

/api/sandbox/bkash-agent/summary/monthly

GET summary/monthly · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$

Statements

GET
/statement/metadata

Statement types and selectable date ranges

Live available

/api/sandbox/bkash-agent/statement/metadata

GET statement/metadata · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
GET
/statement/history

Statement requests and remaining quota

Live available

/api/sandbox/bkash-agent/statement/history

GET statement/history · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
pageSizeOptionalinteger

Query parameter

  • Range: 1 … 50
pageTokenOptionalstring

Query parameter

Cursor from the previous page (omit for the first page).

  • Format: ^[!-~]{1,128}$
  • Length: 0 … 128
POST
/statement/download

Queue a PDF statement (emailed to the agent)

Live available

/api/sandbox/bkash-agent/statement/download

POST statement/download · Parameter
ParameterTypeRules & handling
accountRequiredstring

JSON body

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
fromDateRequireddate

JSON body

  • YYYY-MM-DD
toDateRequireddate

JSON body

  • YYYY-MM-DD
typeOptionalstring

JSON body

  • Allowed values: DETAILED_STATEMENT | SUMMARY_STATEMENT

fromDate ≤ toDate

Transfers

GET
/business-wallet

Business wallet bound to the agent (B2B target)

Live available

/api/sandbox/bkash-agent/business-wallet

GET business-wallet · Parameter
ParameterTypeRules & handling
accountRequiredstring

Query parameter

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
POST
/cash-in

Cash-In from the agent wallet to a customer wallet

Live available

/api/sandbox/bkash-agent/cash-in

Moves real funds only on a supported live integration. Confirm the destination and amount; send a unique Idempotency-Key.

POST cash-in · Parameter
ParameterTypeRules & handling
accountRequiredstring

JSON body

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
customerWalletRequiredstring

JSON body

Customer wallet to credit.

  • Format: ^01\d{9}$
amountRequireddecimal

JSON body

  • Range: 10 … ∞
  • Decimal places: 2
pinRequiredstring

JSON body

Wallet PIN.

Sensitive · never put in URLs

  • Format: ^\d{4,8}$
cashInTypeOptionalstring

JSON body

  • Allowed values: CASH_IN | CASH_IN_VIA_QR
POST
/b2b-transfer

B2B transfer to the bound business wallet

Live available

/api/sandbox/bkash-agent/b2b-transfer

Moves real funds only on a supported live integration. Confirm the destination and amount; send a unique Idempotency-Key.

POST b2b-transfer · Parameter
ParameterTypeRules & handling
accountRequiredstring

JSON body

Agent wallet number (11 digits).

Use a wallet you are authorized to access. Live identities must be linked to your site account through wallet login.

  • Format: ^01\d{9}$
tokenRequiredstring

Send in X-OBG-Token

Session token from the login step. Prefer the X-OBG-Token header so it stays out of URLs.

Sensitive · never put in URLs

  • Format: ^[A-Za-z0-9._~+/=-]{8,512}$
amountRequireddecimal

JSON body

  • Range: 1 … ∞
  • Decimal places: 2
pinRequiredstring

JSON body

Wallet PIN.

Sensitive · never put in URLs

  • Format: ^\d{4,8}$
businessWalletOptionalstring

JSON body

Target business wallet. Omit it to use the wallet bound to the agent.

  • Format: ^01\d{9}$

Endpoint identifiers and provider-specific descriptions are kept in English to match the API contract.

Try in sandbox

A request you can inspect.

The console starts in sandbox mode. Use only the public test values there. Switching to Live changes the destination and may use real accounts and funds.

Sandbox

Keep exploration, account access, and billing separate.

From first request to live connection.

  1. Explore without signing in

    Choose an API and use its sandbox with the documented test values. Fixtures do not move money or contact a bank.

  2. Create your gateway account

    Sign in with Google for 1,000 welcome credits and create an API key. This signs you into the website, not a wallet.

  3. Connect when you are ready

    For a supported live API, complete the wallet login separately. Successful live requests cost one credit; failed requests cost none.

1,000 welcome credits · no card

Small start. Clear cost.

$10 buys 10,000 credits. A successful live request uses one credit; failures and sandbox calls use none. Buying credits does not unlock sandbox-only integrations.

Buy 10,000 credits

Integration guide

Bring it into your code.

Sandbox examples use public fixture values. Live examples use placeholders: keep credentials on your server and never commit them.

Sandbox

curl · POST
curl -X POST 'https://www.openbankinggateway.com/api/sandbox/bkash-agent/login/request-otp' \
  -H 'Content-Type: application/json' \
  --data '{
  "account": "01700000001",
  "phoneOperator": "Grameenphone"
}'

Live available

curl · x-api-key
curl 'https://www.openbankinggateway.com/api/v1/bkash-agent/balance?account=<YOUR_WALLET_NUMBER>' \
  -H "x-api-key: $OBG_API_KEY" \
  -H "X-OBG-Token: $WALLET_TOKEN"

Live bKash wallet sessions are linked to your site account after wallet login. Another site user cannot take over that wallet link. Save the returned wallet token securely and reauthenticate when the provider session expires.

Clear boundaries, before your first request.

A few things worth knowing.

Does the sandbox use real accounts?

No. Sandbox responses are fixtures and use public test credentials. They do not contact a financial provider, send an OTP, or move funds.

Can every API make live requests?

No. Only integrations marked as live have a real upstream. All others are sandbox-only and return LIVE_ACCESS_NOT_ENABLED in live mode. Contact us to discuss access.

When is a credit charged?

One credit is charged for a successful live call. Failed calls and sandbox calls are free. Check X-Credits-Charged rather than HTTP status alone. If X-OBG-Settlement: unknown is present, billing is unresolved: X-Credits-Charged: 0 does not prove that no debit occurred. Check usage and reconcile before retrying.

Does Google sign-in connect my wallet?

No. Google sign-in manages your site account, credits, and API keys. Wallet login is a separate, explicit flow for a supported integration and an account you are authorized to use.

Keep exploring.