generated: '2026-07-18'
method: derived
source: https://developer.bka.sh/docs
description: >-
  Cross-cutting standards posture for the bKash Payment Gateway API, derived from the
  developer portal. bKash uses a proprietary token scheme rather than standard
  OAuth2/OIDC, and a proprietary error-code registry rather than RFC 9457.
standards:
- id: tls-1.2
  conforms: true
  evidence: Docs mandate TLS 1.2 or higher for all API calls; older TLS/SSL rejected.
- id: oauth2
  conforms: false
  evidence: >-
    Token-based auth (Grant/Refresh Token) resembling bearer tokens, but no standard
    OAuth2 grant types or authorization/token metadata are published.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a proprietary numeric errorCode/errorMessage envelope, not application/problem+json.
- id: rfc8594-sunset-header
  conforms: false
- id: webhooks-signed
  conforms: true
  evidence: Instant Payment Notifications delivered over AWS SNS with per-message signatures (SigningCertURL).
- id: pci-dss
  conforms: unverified
  evidence: >-
    bKash is a regulated mobile financial services provider handling card/wallet
    payments; a public PCI DSS certification page was not found on the developer
    portal, so this is not asserted as a published compliance program.
notes: >-
  No published SOC 2 / ISO 27001 / PCI DSS trust page was located on developer.bka.sh
  or bkash.com during enrichment; therefore no Compliance pointer is emitted (no
  fabrication of a compliance program).