This is my code when learn to use BCA API for my office. This code only works on Sandbox environment and there is no confidential information here. FYI, based on my experience if you want to implement this code using real environment of BCA API, you need to do some UAT with BCA side.

BCA_API.php

<?php 

defined('BASEPATH') OR exit('No direct script access allowed');

class BCAAPI extends MY_Controller {
    
    function __construct(){
        $this->api_key = "YOUR API KEY"; 
        $this->api_secret = "YOUR API SECRET";
        $this->client_id = "YOUR CLIENT ID";
        $this->client_secret = "YOUR CLIENT SECRET";                                                                  
    }

    public function get_token(){
        
        $service_url = 'https://sandbox.bca.co.id/api/oauth/token';
        $curl = curl_init();
       
        $headers = array(
            'Authorization:Basic '.base64_encode($this->client_id.":".$this->client_secret).'', 
            'Content-Type:application/x-www-form-urlencoded'
        );
        
        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, "grant_type=client_credentials");
        
        $result = curl_exec($curl);

        // Check HTTP status code
        if (!curl_errno($curl)) {
          switch ($http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE)) {
            case 200:  # OK
              break;
            default:
              $error = 'Unexpected HTTP code: '.$http_code;
              return $error;
          }
        }

        //close curl session
        curl_close($curl);
        var_dump(json_decode($result));
    }

    public function get_signature_balance(){
        $service_url = 'https://sandbox.bca.co.id/utilities/signature';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Timestamp: 2017-03-01T16:23:00.000+07:00',
            'URI: /banking/corporates/BCAAPI2016/accounts/0201245680',
            'AccessToken: d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'APISecret: ab36ba8e-3110-4789-96e2-d466d458935a',
            'HTTPMethod: GET',
            'Content-Type: application/x-www-form-urlencoded'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_signature_statement(){
        $service_url = 'https://sandbox.bca.co.id/utilities/signature';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Timestamp: 2017-03-01T16:10:00.000+07:00',
            'URI: /banking/corporates/BCAAPI2016/accounts/0201245680/statements?StartDate=2016-09-01&EndDate=2016-09-01',
            'AccessToken: d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'APISecret: ab36ba8e-3110-4789-96e2-d466d458935a',
            'HTTPMethod: GET',
            'Content-Type: application/x-www-form-urlencoded'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_balance(){
        $service_url = 'https://sandbox.bca.co.id/banking/corporates/BCAAPI2016/accounts/0201245680';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Authorization:Bearer d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'X-BCA-Key:3ff80577-aab2-4dea-82a5-900141b4f501',
            'X-BCA-Signature:33aabfee70392c5068974b2f7f1eeba26b4271d2f950ff0e2c66038db79b82ba',
            'X-BCA-Timestamp:2017-03-01T16:23:00.000+07:00'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_HTTPGET, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_statement(){
        $service_url = 'https://sandbox.bca.co.id/banking/corporates/BCAAPI2016/accounts/0201245680/statements?StartDate=2016-09-01&EndDate=2016-09-01';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Authorization:Bearer d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'X-BCA-Key:3ff80577-aab2-4dea-82a5-900141b4f501',
            'X-BCA-Signature:2f61c8731d13711bf9cc017da49101c6086550f6be4b920cfbeb633029cd7f4f',
            'X-BCA-Timestamp:2017-03-01T16:10:00.000+07:00'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_HTTPGET, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_exec($curl);
        curl_close($curl);
    }
    
}

@dertajora I am trying to achieve the same, thanks for the code, I need help in payment initiate function where we need to create the signature
I am following the doc to generate for sandbox API but the error is always hmac_mismatch
Can you help me with this?
After Token and Signature, I am trying the API here
https://developer.bca.co.id/api-catalog/apitester/tests/SakukuCommerce/api#!/sakuku-commerce/createPayment