Start safe. Connect deliberately.

Choose the integration first and check its availability badge. Every app has a fixture-based sandbox; a live endpoint exists only when the catalog explicitly says so. API paths are not localized.

Sandbox base URL

https://www.openbankinggateway.com/api/sandbox

Live base URL

https://www.openbankinggateway.com/api/v1

The site console uses relative, same-origin /api/sandbox requests. This anonymous fixture service needs no Google login, API key, wallet account, or credits. It is not a public cross-origin browser proxy; run browser examples on this site, or use a server-side HTTP client.

Use only the public test identities and credentials shown on product pages and in the console. Sandbox transfers are simulated, no SMS is sent, and its tokens do not work in Live mode.

const response = await fetch('/api/sandbox/bkash-agent/login/request-otp', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    account: '01700000001',
    phoneOperator: 'Grameenphone'
  })
});
const result = await response.json();

curl -X POST 'https://www.openbankinggateway.com/api/sandbox/bkash-agent/login/request-otp' \
  -H 'Content-Type: application/json' \
  --data '{
  "account": "01700000001",
  "phoneOperator": "Grameenphone"
}'

For server-to-server live requests, sign in to the site, create a key in Dashboard → API keys, and send it in x-api-key. Never expose a gateway API key in browser JavaScript, a URL, or a public repository. Only supported live integrations can be called.

curl 'https://www.openbankinggateway.com/api/v1/bkash-agent/balance?account=<YOUR_WALLET_NUMBER>' \
  -H "x-api-key: $OBG_API_KEY" \
  -H "X-OBG-Token: $WALLET_TOKEN"

Google sign-in authenticates your Open Banking Gateway account and gives access to credits, keys, and billing. It does not authenticate you to bKash or any other wallet. Complete the selected wallet's documented login flow separately, using an account you are authorized to operate.

Live bKash wallet sessions are linked to your site account after wallet login. Another site user cannot take over that wallet link. Save the returned wallet token securely and reauthenticate when the provider session expires.

1. 1POST /login/request-otp
2. 2POST /login/verify-otp

curl -X POST 'https://www.openbankinggateway.com/api/v1/bkash-agent/login/verify-otp' \
  -H "x-api-key: $OBG_API_KEY" \
  -H 'Content-Type: application/json' \
  --data '{
    "account": "<YOUR_WALLET_NUMBER>",
    "pin": "<WALLET_PIN>",
    "otp": "<SMS_OTP>",
    "otpHash": "<SMS_HASH>"
  }'

Send the wallet session token in X-OBG-Token. Send PINs, passwords, OTPs, and otpHash in the JSON body on POST endpoints, with Content-Type: application/json. Query-string compatibility exists, but sensitive values in URLs can leak into history, screenshots, referrers, or logs—do not use it in new integrations.

One successful live call costs 1 credit. Failed calls are free, including provider failures; sandbox requests never consume credits. A temporary 1-credit hold may appear while a live call is in flight, then it is charged or released when the result is settled.

Your first Google sign-in grants 1,000 welcome credits once. Buy 10,000 credits for $10, 50,000 for $50, or 100,000 for $100. Credits do not expire. Buying credits does not grant live access to sandbox-only APIs.

Gateway responses use a {code, data} envelope. The gateway code, HTTP status, and a nested provider status describe different layers: HTTP 200 or gateway code 200 alone does not prove a wallet operation succeeded. Inspect the endpoint's provider-specific result fields. A nested provider failure is not charged, even with outer code 200. An unrecognized provider response shape returns HTTP 502 with UPSTREAM_BAD_RESPONSE and is free. No extra raw-response field is guaranteed.

{
  "code": 400,
  "data": {
    "error": "One or more parameters are missing or invalid.",
    "errorCode": "INVALID_PARAMS",
    "requestId": "<request-id>"
  }
}

X-Request-Id identifies the gateway request. When settlement is confirmed, X-Credits-Charged is 1 for a charged successful live call and 0 for a failed or sandbox call. X-OBG-Settlement: unknown means the billing outcome is unresolved: X-Credits-Charged: 0 is not proof that no debit occurred. Retain the request ID, not credentials, for troubleshooting.

Money-moving live endpoints require a unique Idempotency-Key for each intended operation. Keep the same key when resolving that operation; never create a new key just to retry an uncertain transfer. The gateway does not automatically retry upstream calls.

Idempotency-Key: <original-operation-id>
X-Request-Id: <gateway-request-id>
X-Credits-Charged: 0
X-OBG-Settlement: unknown

The free sandbox is limited to 60 requests per minute per IP. Other live and account limits also apply. On 429, respect Retry-After. Read timeouts are 25 seconds; login, writes, and money-moving calls can take up to 45 seconds.

Each product page contains the exact endpoint list and parameter rules, plus a sandbox-first console. Availability comes from the shared catalog, not from a credit purchase.

• EasyPaisa (Phoenix)Pakistan
  Sandbox only
• ACB ONEVietnam
  Sandbox only
• slice BusinessIndia
  Sandbox only
• bKash AgentBangladesh
  Live available
• Nagad UddoktaBangladesh
  Sandbox only
• Nagad CustomerBangladesh
  Sandbox only