Reaching the offers and applications inside Dost Loan

A person using Dost Loan sees personal-loan offers laid out side by side — amounts from roughly ৳1,000 to ৳60,000, tenures between about 91 and 360 days, and an APR the app caps near 14.6% per its store description. That comparison grid, and everything behind it, is the asset worth integrating. The app does not lend directly; it matches a borrower profile against products from certified partner lenders, which means the records it holds are richer than a single lender's would be — many lenders' rates, limits and terms, plus the applicant's own profile and chosen application.

Bangladesh has no live open-banking data-sharing scheme yet, so the route we actually run is the account holder's own authorization to their data, captured through documented protocol analysis of the app's traffic. That is dependable today and does not wait on a regulator. Below: the data domains, the routes, the deliverable, and how we build it.

What sits behind a Dost Loan account

These map to surfaces the app exposes to a logged-in user, named the way the app frames them.

Routes to the data

User-consented access with protocol analysis

The borrower authorizes access to their own account; we capture and document the app's request and response traffic — login, token exchange, the offers and application endpoints — and rebuild those calls as a clean interface. This reaches everything the user can see in the app: offers, application status, repayment schedules. Durable enough for production with a re-validation pass when the app's front end shifts. This is the route we recommend for Dost Loan, because the aggregator's value is the merged per-lender view, and that view is only fully present inside an authenticated session.

Native export

Where the app or its email receipts (statements sent to the registered address) expose a structured artifact, we parse it as a low-effort supplement. Coverage is narrower than the live route and lags real time, so we use it to corroborate rather than as the spine.

Regulated account aggregation — forward-looking

Bangladesh Bank is expected to publish open-banking guidelines and standard API protocols around June 2026, per reporting in The Business Standard, with a working committee ahead of that. Once a participant scheme exists for the lenders behind the app, the same normalized schema we deliver can move onto consent-based aggregation. We design for that move now; we do not gate today's work on it. Access for whichever route applies is arranged with you during onboarding.

The deliverable

You give us the app name and what you want out of it. What comes back, tied to Dost Loan's actual surfaces:

• An OpenAPI 3 spec for the offers, application and repayment endpoints, with stable English field keys mapped off the Bengali display labels.
• A protocol and auth-flow report: the login, token issue and token-refresh chain as observed during the build, with the cookie or bearer handling the app uses.
• Runnable source for the key calls in Python and Node.js — fetch offers, read an application, pull a repayment schedule — with retry and error handling.
• A normalized schema that preserves per-lender attribution and reconciles APR against the daily-rate figure so cost is not double-counted.
• Automated tests against captured fixtures, plus interface documentation.
• Data-handling guidance: consent capture, retention limits, and what to log under the 2025 ordinance.

A call, sketched

Illustrative shape, not a published contract — exact paths and field names are confirmed during the build against captured traffic.

POST /api/v1/auth/token
{ "msisdn": "+8801XXXXXXXXX", "otp": "######" }
-> 200 { "access_token": "…", "refresh_token": "…", "expires_in": 1800 }

GET /api/v1/offers?profile_id=…        (Authorization: Bearer …)
-> 200 {
     "offers": [
       { "lender": "partner_a", "amount_min": 1000, "amount_max": 60000,
         "tenor_days": 180, "apr": 14.6, "daily_rate": 0.04, "currency": "BDT" }
     ],
     "matched_on": "profile" }

# token lifetime is short; on 401 we replay the refresh grant before re-reading.
# numerals in payloads are Latin-digit even though the UI renders Bengali.

Where integrators take this

• A comparison or broker site ingesting live partner-lender rates from one normalized feed instead of scraping each lender.
• A lender reconciling its own products as they appear inside the aggregator, watching for stale pricing.
• A collections or affordability tool reading the repayment schedule a borrower accepted.
• An analytics team tracking offer mix and APR spread across the partner panel over time.

Consent and the law that applies

Bangladesh's Personal Data Protection Ordinance 2025, gazetted with a National Data Governance Authority to enforce it, treats the individual as owner of their personal data and makes explicit consent mandatory before collection, storage or transfer — financial data is named in scope. Parts of the ordinance phase in months after notification, as reported by The Daily Star. For an integration of Dost Loan that means consent is scoped to the data domains the borrower actually authorizes, is time-bound and revocable, and the build captures only what the use case needs. Bangladesh Bank's digital-lending directives separately require lenders to disclose all charges in advance, which is why the cost and repayment fields are first-class in our schema. We operate authorized and logged, keep consent records, minimize retained data, and sign an NDA where the work touches sensitive flows.

How we build it for this app

Two things about Dost Loan shape the work, and we handle both:

• It is an aggregator, so a single offers response can carry several lenders. We model each lender's offer schema on its own and keep the partner identity, rate and tenure attached per row, so a unified feed never collapses two lenders into one ambiguous record.
• It states cost two ways — an APR near 14.6% and a daily rate near 0.04% per its listing. We normalize the interest representation, carrying the raw fields plus a derived effective-cost value, so downstream comparison logic does not double-count.
• The applicant flow includes identity verification with a short-lived session. We design the sync around the token's lifetime and its refresh grant so a pull does not silently expire mid-run, and when the app's screens change we re-run a validation pass against captured traffic before shipping an update.

Access is arranged with you during onboarding — the build runs against a consenting account, never against credentials you have to defend on this page.

Cost and timeline

Source for the offers, application and repayment-schedule calls is a one-to-two-week build for an app of this shape. Two engagement models, priced to match. Source-code delivery starts at $300: you receive runnable source, the OpenAPI spec, tests and interface documentation, and you pay only after delivery once it works to your satisfaction. Or take the hosted route — call our endpoints and pay per call, with no upfront fee. Tell us the app and what you need from it, and we set up the rest. Start a Dost Loan integration.

App screens

What was checked

We read the Google Play listing for product terms and the package identifier, the Personal Data Protection Ordinance 2025 coverage, Bangladesh Bank's open-banking timetable reporting, and same-category loan apps in the Bangladesh market. Checked June 2026.

• Dost Loan on Google Play
• Personal Data Protection Ordinance 2025 — The Daily Star
• Bangladesh open-banking plans — The Business Standard
• Open banking in Bangladesh — The Financial Express

Mapping reviewed 2026-06-28 by the OpenBanking Studio integration desk.

Similar apps in the same space

Other Bangladesh lending and comparison apps an integrator often unifies alongside Dost Loan, for context, not ranking.

• bKash Loan — instant nano-loans inside the bKash wallet; holds disbursement and repayment records.
• Nagad — mobile financial service with loan and credit features; per-user transaction and balance data.
• eRin — salaried-professional loans from TSLC Global; application and repayment records.
• BBL Shubidha — BRAC Bank's end-to-end digital retail lending; account-linked loan data.
• Phandora Credit — small personal loans; application status and schedules.
• SC Mobile — Standard Chartered's app with personal-loan origination; statement and loan data.
• Drutoloan — collateral-free MSME lending; business borrower and loan records.
• Aamartaka — loan and credit-card comparison; offer and eligibility data.

Questions integrators ask

Can you separate offers by partner lender, or only the merged comparison view?

Both. The app presents a merged side-by-side comparison, but each row carries its originating partner lender, rate, tenure and limit. We model each lender's offer schema separately so a normalized feed keeps the per-partner attribution intact rather than flattening everything into one anonymous list.

Does Bangladesh's open-banking timetable change how you reach Dost Loan today?

Not for the build we run now. Bangladesh Bank is expected to issue open-banking guidelines and standard API protocols around June 2026, with a working committee earlier; until those are live the dependable basis is the account holder's own authorization to their data. If a formal AIS scheme later applies to lenders behind the app, the same normalized schema can move onto it.

How do you handle the APR and daily-rate figures the app shows side by side?

Dost Loan publishes both a maximum APR around 14.6% and a maximum daily rate around 0.04% per its listing. We normalize the interest representation in the delivered schema, keeping the raw fields the app returns and a derived effective-cost figure, so a downstream system does not double-count interest when it compares offers.

Is the data in Bengali, and does that affect the delivered fields?

The consumer screens are in Bengali and amounts use Bengali numerals. We capture the underlying API payloads, which are usually Latin-digit and machine-readable, and map labels to stable English keys in the OpenAPI spec so your systems are not parsing localized display strings.