M-Pesa Integration for Websites and Apps: A Complete Guide for Kenyan Businesses

M-Pesa is not just a payment method in Kenya — it is the backbone of commerce. Over 30 million Kenyans use M-Pesa regularly, and for many businesses, accepting M-Pesa is the difference between making a sale and losing a customer.

But "accepting M-Pesa" means more than displaying a paybill number on your website. True M-Pesa integration means your website, app, POS, or e-commerce store can request payments automatically, confirm them instantly, and update your records without manual intervention.

This guide covers everything Kenyan businesses need to know about integrating M-Pesa using the Safaricom Daraja API — the methods, the costs, the timelines, and the common mistakes.

Who this is for: Business owners, developers, and decision-makers in Kenya who want to accept M-Pesa payments on their website, mobile app, POS system, or e-commerce store.

What is the Safaricom Daraja API?

Daraja is Safaricom's official API platform for M-Pesa integration. It allows developers to build M-Pesa payments directly into websites, apps, and business systems.

Daraja supports several payment methods:

For most businesses, STK Push is the primary integration method. It provides the smoothest customer experience — the customer does not need to leave your website or app to make a payment.

How STK Push works (step by step)

1. Customer clicks "Pay with M-Pesa" on your website or app
2. Your system calls the Daraja API with the amount and customer phone number
3. The customer receives an M-Pesa prompt on their phone
4. Customer enters their M-Pesa PIN to approve
5. Safaricom processes the payment
6. Daraja sends a callback to your server with the transaction result
7. Your system confirms the payment and updates the order status automatically

The entire process takes 5–15 seconds. No manual confirmation needed. No checking your M-Pesa statement to see if the customer paid.

What you need before integrating M-Pesa

Before you can integrate, you need:

1. A Safaricom Daraja account

Register at developer.safaricom.co.ke. You will get:

• A Consumer Key and Consumer Secret (used to authenticate API requests)
• Access to the sandbox (test environment) for development
• Access to the production environment after testing

Registration is free. You only pay transaction fees on actual payments processed.

2. A business paybill or till number

To receive payments, you need either:

• A Paybill number (for invoicing, subscriptions, online payments)
• A Till number (for retail and in-person payments)

You can register for a paybill/till at any Safaricom shop. You will need:

• Business registration documents (CR12, certificate of incorporation)
• KRA PIN certificate
• Director's ID
• A letter requesting the paybill/till

Processing typically takes 3–7 working days.

3. A secure server (with HTTPS)

Daraja API callbacks (payment confirmations) are sent to a URL on your server. This URL must:

• Be publicly accessible (not localhost)
• Use HTTPS (Safaricom does not send callbacks to HTTP URLs)
• Respond quickly (under 3 seconds) — if your server is slow, Safaricom may retry or skip the callback

4. Callback URL handling

Your system needs an endpoint that:

• Receives the payment confirmation from Safaricom
• Validates the transaction (check amount, account reference, customer)
• Updates your order/payment record
• Returns a success response to Safaricom

If your callback URL fails, payments may be processed but your system will not know about them — leading to orders that are never fulfilled.

M-Pesa integration methods

Option 1: Direct Daraja API integration

You build the integration yourself (or hire a developer). This gives full control and the lowest transaction costs.

Pros:

• Full control over the payment flow
• No middleware fees
• Can customise the experience entirely
• Direct access to all Daraja features

Cons:

• Requires development expertise
• You handle security, error handling, and edge cases
• Safaricom support is limited to API documentation

Cost:

• Development: KES 15,000–60,000 (one-time, depending on complexity)
• Transaction fees: Safaricom's standard M-Pesa transaction fees (same as any M-Pesa payment)
• No monthly fees

Timeline: 1–3 weeks (including sandbox testing and production go-live)

Option 2: Payment aggregator / middleware

Companies like Africa's Talking, Pesapal, and Jenga provide M-Pesa integration as a service. They wrap the Daraja API in simpler APIs and handle callbacks, reconciliation, and reporting for you.

Pros:

• Faster to integrate (simpler API)
• Aggregator handles error cases and retries
• Additional features: reporting dashboards, multi-currency, fraud detection
• Customer support

Cons:

• Additional transaction fee on top of Safaricom's fee (typically 1–3 %)
• You depend on the aggregator's uptime
• Less control over the payment flow
• Data passes through a third party

Cost:

• Setup: Often free
• Transaction fees: Safaricom fee + 1–3 % aggregator fee
• Some aggregators charge monthly minimums

Timeline: 3–7 days

Option 3: E-commerce platform plugins

If you use WordPress (WooCommerce), Shopify, or OpenCart, pre-built M-Pesa plugins exist. You install the plugin, enter your Daraja credentials, and payments work.

Pros:

• Fastest setup (hours, not weeks)
• No development needed
• Maintenance handled by plugin developer

Cons:

• Limited to what the plugin supports
• Plugin quality varies widely — some are poorly maintained
• May not support advanced features (refunds, partial payments, split payments)
• Plugin updates can break your integration

Cost:

• Plugin: KES 5,000–25,000 (one-time or annual licence)
• Transaction fees: Safaricom standard fees only

Timeline: Same day to 2 days

Common M-Pesa integration mistakes

1. Not handling failed callbacks

Safaricom sends a callback for every transaction — success or failure. Many integrations only handle the success callback and ignore failures. This means:

• A customer's payment fails but your system shows the order as paid
• Or the payment succeeds but the callback times out and your system never records it

Fix: Always handle both success and failure callbacks. Log every callback. Implement reconciliation — periodically check your M-Pesa statement against your system records.

2. Hardcoding sandbox credentials

It sounds obvious, but many developers forget to switch from sandbox to production credentials before launch. Payments work in testing but fail in production.

Fix: Use environment variables for all credentials. Never hardcode keys in source code.

3. Not validating the account reference

When a customer pays via paybill, they enter an account reference (e.g., an invoice number or customer ID). Your system should validate this reference — otherwise, you receive money but cannot match it to an order.

Fix: Generate unique account references for each transaction. Validate the reference in your callback handler.

4. Ignoring rate limits

Daraja API has rate limits. If you send too many STK push requests in a short period, Safaricom blocks your application.

Fix: Implement rate limiting on your end. Queue payment requests if necessary. Do not retry failed requests immediately — use exponential backoff.

5. Not testing edge cases

Many integrations work for the happy path (customer pays, payment succeeds) but fail when:

• Customer does not respond to the STK prompt (timeout)
• Customer has insufficient funds
• Customer's phone is off
• Network is down
• Duplicate payment (customer pays twice)

Fix: Test every edge case in the sandbox before going to production.

M-Pesa integration for different business types

E-commerce store

• Customer adds items to cart
• At checkout, selects "Pay with M-Pesa"
• STK push sent to their phone
• On confirmation, order status changes to "Paid" automatically
• Inventory updated, confirmation email/SMS sent

Restaurant or retail POS

• Cashier enters order in POS
• Customer selects M-Pesa at checkout
• STK push sent, or customer enters paybill/till
• POS records payment, prints receipt
• Daily M-Pesa reconciliation report generated automatically

SaaS or subscription business

• Customer signs up and enters their M-Pesa number
• Monthly STK push sent automatically
• If payment fails, system sends reminder and retries
• Subscription paused/cancelled if payment fails after X attempts

School or institution

• Parents pay fees via paybill
• System matches payment to student using account reference (admission number)
• Receipt generated automatically
• Fee balance updated in real time
• Parent receives SMS confirmation

M-Pesa integration cost summary

Timeline for a typical M-Pesa integration

What to do next

If you want to accept M-Pesa payments on your website, app, or POS system, the first step is understanding what integration method fits your business.

Orwan Consulting builds custom M-Pesa integrations for Kenyan businesses — direct Daraja API, aggregator-based, and platform plugins. We handle the entire process from registration to production go-live.

Schedule your free consultation — we will review your current system, recommend the best integration approach, and provide a fixed-cost proposal.

Related reading:

• How Much Does a Website Cost in Kenya? A 2026 Pricing Guide — includes M-Pesa integration costs
• POS System Cost in Kenya: What to Expect in 2026 — M-Pesa integration is a core POS feature