BCA Link

BCA Link is an optional, free, live-mode-only payment-detection source for BCA QR Merchant accounts. Link your account once, and the gateway’s own poller watches that account’s transaction feed server-side whenever you have unpaid transactions.

Unlike GoBiz Link and ShopeePay Link, BCA Link is not a second detector next to a working device-side fallback: BCA’s own merchant app notifications aren’t readable by the App Listener, so for BCA merchants this is the only automated detection option. Without it, a BCA payment must be reconciled manually.

Poller matches feed the exact same matching pipeline as every other detector, so nothing conflicts — a match marks the transaction paid and fires your webhook, recorded in the inbound audit log with payment_source: "bca_poll" plus the BCA transaction reference number.

Unofficial API notice. The poller talks to the same private API the BCA QR Merchant dashboard uses — not an official integration. BCA may change authentication, add rate limits, or invalidate sessions at any time, and accounts driven by automated clients risk suspension. Link at your own discretion. If linking breaks, nothing about payments breaks: the tenant simply has no automated BCA detection until re-linked (see Session health below).

Coverage is BCA QR Merchant only. Payments arriving through GoPay, ShopeePay, DANA, or other apps are still detected by their own sources (GoBiz Link, ShopeePay Link) or the App Listener — keep it running even with BCA linked. These are complements, not alternatives.

Linking your account

Provide your BCA QR Merchant login (the same username and password you use at qr.klikbca.com) and your merchant id. The gateway verifies it works before storing anything — a bad login returns an error and nothing is saved.

Endpoints

All three require your live X-API-Key — a sandbox key gets VALIDATION_ERROR (sandbox has simulate-payment instead).

Method	Endpoint	Description
POST	/v1/bca-link/import-credentials	Link your BCA QR Merchant account; stores it encrypted and activates polling
GET	/v1/bca-link	Link status
DELETE	/v1/bca-link	Unlink (idempotent) — deletes the stored link

1. Link the account

curl -X POST https://api-qris-gateway.laboon.id/v1/bca-link/import-credentials \
  -H "X-API-Key: your_live_api_key" \
  -H "Content-Type: application/json" \
  -d '{ "username": "your_bca_qr_merchant_username", "password": "your_bca_qr_merchant_password", "mid": "your_merchant_id" }'

{
  "success": true,
  "message": "BCA account linked",
  "data": { "linked": true, "status": "active", "mid": "004582778", "outlet_name": "…" }
}

Your login is verified live before anything is stored — wrong credentials return 400 VALIDATION_ERROR and nothing is saved. Re-linking while already linked simply replaces the stored link (there is at most one BCA link per tenant), and clears needs_relink back to active.

Your login is stored encrypted (AES-256-GCM) and is never returned by any endpoint.

2. Status and unlink

curl https://api-qris-gateway.laboon.id/v1/bca-link -H "X-API-Key: your_live_api_key"
curl -X DELETE https://api-qris-gateway.laboon.id/v1/bca-link -H "X-API-Key: your_live_api_key"

GET returns { "linked": false } or the link’s status, mid, outlet_name, and timestamps. DELETE is idempotent — unlinking twice is still a 200.

How polling behaves

• The poller only runs for a tenant while it has at least one unpaid live transaction — an idle tenant costs nothing.
• A feed settlement is matched with the same by-amount rules as the App Listener, but with two extra freshness guards on the poller’s side: a transaction is only reported if it’s newer than everything already scanned and falls inside a currently-unpaid transaction’s own time window. An older same-amount settlement can never pay a newer transaction.
• If BCA rate-limits the account, that tenant’s polling pauses briefly and resumes on its own. Other tenants are unaffected.
• Your session is kept usable automatically in the background — including re-authenticating with your stored login when needed — so there’s nothing to do day-to-day once linked.

Session health

GET /v1/bca-link reports one of:

• active — polling normally.
• needs_relink — BCA rejected the stored login or session (password changed, account action required, or similar). The poller has stopped for this tenant. Link again with your current credentials to restore polling — this replaces the dead link in place.

There is no error state that affects payment processing on other providers: every BCA-side failure degrades to no automated BCA detection, never to lost payments overall — the App Listener and any other linked providers keep working independently.