Bkash Authentication

generated: '2026-07-18'
method: searched
source: https://developer.bka.sh/docs/token-management-overview.md
docs: https://developer.bka.sh/docs/token-management-overview-1.md
summary:
  types: [token, apiKey]
  model: >-
    App-credential bootstrap then bearer-style id_token. Merchant obtains an
    id_token via the Grant Token API using onboarding credentials (username,
    password, app_key, app_secret), then sends that token in the Authorization
    header plus X-App-Key on every payment API call. No standard OAuth2/OIDC
    discovery is published; the token scheme is bKash-proprietary.
schemes:
- name: GrantToken
  type: token
  in: header
  header: Authorization
  value: id_token returned by Grant Token API
  token_lifetime_seconds: 3600
  refresh: >-
    Call Refresh Token API (or Grant Token again) before the token expires
    (around the 50th/55th minute). Do not call more than twice within an hour or
    the caller is blocked for one hour.
  grant_endpoint: '{base_URL}/tokenized/checkout/token/grant'
  refresh_endpoint: '{base_URL}/tokenized/checkout/token/refresh'
  credentials: [username, password, app_key, app_secret]
- name: AppKey
  type: apiKey
  in: header
  header: X-App-Key
  value: Application Key shared by bKash during onboarding
  applied_to: All payment/agreement/refund operations alongside the Authorization token.
notes: >-
  Credentials (app_key, app_secret, username, password) are issued during bKash
  merchant onboarding — separate sandbox and production credential sets. Tokens
  are scoped to the actions permitted for the merchant account.