Devices & SMS ingestion

Get the app

Download the signed Android forwarder and install it on the phone that receives your bKash, Nagad or Rocket SMS. It runs on Android 8.0 or newer and installs as a normal APK — no Play Store account is needed.

Version 2.0.0 listens to both the SMS broadcast and app notifications, tags each message with its SIM slot, keeps a light foreground watchdog alive and restarts itself after a reboot or when the app is swiped away.

The app filters messages on the phone and only uploads confirmations that contain a transaction ID and an amount, or that match keywords you add yourself.

Pairing

Create a device in the dashboard and copy its token to the forwarder app. Tokens start with tfdev_ and can be revoked at any time. A revoked device stops ingesting immediately.

Ingestion endpoint

Send the raw message and let the parser extract everything. If your bridge already parses the SMS, send structured fields instead: provider, amount, trx_id, sender_number and new_balance. The device token can also be sent as Authorization: Bearer <token>.

Optional fields: sim_slot (integer, for dual-SIM phones) and source (sms, notification or bridge). They are stored for audit and shown on the SMS record.

curl -X POST https://your-domain.com/api/device/ingest \
  -H "X-Device-Token: tfdev_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "You have received Tk 1,250.00 from 01712345678. TrxID TFDEMO1234. Your new balance is Tk 4,500.00.",
    "received_at": "2026-10-29T14:20:08+06:00"
  }'

What the parser extracts

• Provider — from the sender ID and message phrasing.
• Amount and currency.
• TrxID (also called TxnID, Transaction ID or Trx ID depending on provider).
• Sender number, when present.
• New balance, used for the running-balance check.

Parse results

• used — the SMS matched a pending payment and settled it.
• approved — stored as verified data and available for future matching. If the confidence engine found a likely payment, the score and reasons are attached and the payment shows a suggestion.
• review — the running-balance check failed or the match was ambiguous; a human must decide, with the evidence panel on the SMS and payment.
• Duplicate TrxIDs are rejected at ingestion with a 400 response. A duplicate notification for an SMS already forwarded is acknowledged and ignored.

Building your own bridge

Any service that can POST JSON with the device token is a valid bridge — Tasker, a Raspberry Pi listening to a GSM modem, or an SMPP gateway. Send the raw message body unchanged so the parser and audit log can do their job.