This is my code when learn to use BCA API for my office. This code only works on Sandbox environment and there is no confidential information here. FYI, based on my experience if you want to implement this code using real environment of BCA API, you need to do some UAT with BCA side.

BCA_API.php

<?php 

defined('BASEPATH') OR exit('No direct script access allowed');

class BCAAPI extends MY_Controller {
    
    function __construct(){
        $this->api_key = "YOUR API KEY"; 
        $this->api_secret = "YOUR API SECRET";
        $this->client_id = "YOUR CLIENT ID";
        $this->client_secret = "YOUR CLIENT SECRET";                                                                  
    }

    public function get_token(){
        
        $service_url = 'https://sandbox.bca.co.id/api/oauth/token';
        $curl = curl_init();
       
        $headers = array(
            'Authorization:Basic '.base64_encode($this->client_id.":".$this->client_secret).'', 
            'Content-Type:application/x-www-form-urlencoded'
        );
        
        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, "grant_type=client_credentials");
        
        $result = curl_exec($curl);

        // Check HTTP status code
        if (!curl_errno($curl)) {
          switch ($http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE)) {
            case 200:  # OK
              break;
            default:
              $error = 'Unexpected HTTP code: '.$http_code;
              return $error;
          }
        }

        //close curl session
        curl_close($curl);
        var_dump(json_decode($result));
    }

    public function get_signature_balance(){
        $service_url = 'https://sandbox.bca.co.id/utilities/signature';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Timestamp: 2017-03-01T16:23:00.000+07:00',
            'URI: /banking/corporates/BCAAPI2016/accounts/0201245680',
            'AccessToken: d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'APISecret: ab36ba8e-3110-4789-96e2-d466d458935a',
            'HTTPMethod: GET',
            'Content-Type: application/x-www-form-urlencoded'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_signature_statement(){
        $service_url = 'https://sandbox.bca.co.id/utilities/signature';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Timestamp: 2017-03-01T16:10:00.000+07:00',
            'URI: /banking/corporates/BCAAPI2016/accounts/0201245680/statements?StartDate=2016-09-01&EndDate=2016-09-01',
            'AccessToken: d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'APISecret: ab36ba8e-3110-4789-96e2-d466d458935a',
            'HTTPMethod: GET',
            'Content-Type: application/x-www-form-urlencoded'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_POST, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_balance(){
        $service_url = 'https://sandbox.bca.co.id/banking/corporates/BCAAPI2016/accounts/0201245680';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Authorization:Bearer d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'X-BCA-Key:3ff80577-aab2-4dea-82a5-900141b4f501',
            'X-BCA-Signature:33aabfee70392c5068974b2f7f1eeba26b4271d2f950ff0e2c66038db79b82ba',
            'X-BCA-Timestamp:2017-03-01T16:23:00.000+07:00'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_HTTPGET, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_exec($curl);
        curl_close($curl);
    }

    public function get_statement(){
        $service_url = 'https://sandbox.bca.co.id/banking/corporates/BCAAPI2016/accounts/0201245680/statements?StartDate=2016-09-01&EndDate=2016-09-01';
        $curl = curl_init();

        $curl_post_data = array();
        $headers = array(
            'Authorization:Bearer d6E3b3OSJKKtsvZ67wkSJc99VvZtSyJGeEZ1nMDjCXODJZsywU1q20',
            'X-BCA-Key:3ff80577-aab2-4dea-82a5-900141b4f501',
            'X-BCA-Signature:2f61c8731d13711bf9cc017da49101c6086550f6be4b920cfbeb633029cd7f4f',
            'X-BCA-Timestamp:2017-03-01T16:10:00.000+07:00'
        );
         

        curl_setopt($curl, CURLOPT_URL, $service_url); 
        curl_setopt($curl, CURLOPT_HTTPGET, 1);
        curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
        curl_exec($curl);
        curl_close($curl);
    }
    
}