How to Integrate M-Pesa Payments Into Your Website or App in Kenya (Daraja API Guide)

A customer loves your product, adds it to the cart, and then hits a wall: no way to pay with M-Pesa. In Kenya, that is often where the sale ends. Adding M-Pesa to your website or app is one of the highest-impact upgrades you can make, and it is more achievable than most business owners think.

In this guide

1. Why M-Pesa matters for your business
2. What is the Daraja API?
3. Which M-Pesa option should you use?
4. The 6-step integration process
5. Common mistakes to avoid
6. Frequently asked questions

Why M-Pesa Matters for Your Business

For many Kenyan customers, mobile money is the default way to pay. If your checkout only accepts cards, you are shutting out people who are ready to buy. A smooth M-Pesa experience reduces abandoned carts, speeds up payment confirmation, and removes the manual work of matching payments to orders by hand.

It also improves your internal operations. When payments are confirmed automatically, your system can issue receipts, update stock, activate subscriptions or unlock a service without anyone having to check a phone or statement. That is the same thinking behind many of the custom software projects we build with Kenyan businesses: remove repetitive manual steps so your team can focus on growth.

What Is the Daraja API?

Daraja is Safaricom’s developer platform for M-Pesa. It lets your website or app talk directly to M-Pesa: request a payment, receive a confirmation, check a transaction status and more. You can explore the official documentation on the Safaricom Daraja developer portal.

In simple terms, the flow looks like this:

• Your server authenticates with Daraja using your app’s credentials and receives a temporary access token.
• Your server sends a payment request with the amount, the customer’s phone number and a reference.
• The customer approves the payment on their phone.
• Safaricom sends the result to your callback URL, and your system updates the order.

Which M-Pesa Option Should You Use?

Daraja offers several APIs. For most businesses, the choice comes down to a few common ones:

• M-Pesa Express (STK Push): your system triggers a payment prompt on the customer’s phone and they just enter their PIN. Best for online checkouts, subscriptions and in-app payments.
• C2B (Customer to Business): customers pay your Paybill or Till number themselves, and your system receives a notification. Useful when people pay manually, for example from a bill or invoice.
• B2C (Business to Customer): your business sends money to customers, for example for refunds, payouts or salaries.
• Transaction status and reversals: tools to check what happened to a payment and handle exceptions.

If you are selling online, STK Push is usually the right place to start. Many businesses then add C2B so that payments made directly to the Paybill or Till are also recognised by the system.

The 6-Step Integration Process

Step 1: Register and create an app on Daraja

Create a developer account, then create an app and select the APIs you need. You will receive a consumer key and consumer secret for testing. Store them in secure environment variables, not in your source code.

Step 2: Plan the payment flow before you write code

Decide what should happen at every stage: payment requested, payment confirmed, payment cancelled, payment failed and payment timed out. Map each outcome to an order status so customers are never left guessing. A clear flow saves hours of rework later and is a core part of good website development.

Step 3: Build and test in the sandbox

Daraja provides a sandbox so you can test without moving real money. Use it to test successful payments, cancelled prompts, wrong PINs and timeouts. Remember that sandbox behaviour and test credentials are not identical to live, so plan a final round of careful testing when you go live.

Step 4: Set up a secure callback URL

Safaricom sends payment results to your callback URL, so it must be publicly reachable over HTTPS. Treat every incoming callback as untrusted until you have checked it: match it to a pending order, confirm the amount, and make sure the same payment cannot be processed twice. Log everything so you can investigate disputes quickly.

Step 5: Reconcile payments automatically

Callbacks can occasionally fail to arrive. Build a fallback that checks the status of pending payments after a short delay, and a daily reconciliation report that compares your records with your M-Pesa statement. This is what separates a demo from a system you can trust with real revenue.

Step 6: Go live

When testing is complete, you apply to move your integration to production using your own Paybill or Till number. The exact requirements and approval steps are set by Safaricom and can change, so check the current process on the Daraja portal and allow time for approval before your launch date.

Common Mistakes to Avoid

• Exposing API keys in front-end code or public repositories.
• Marking an order as paid before the confirmation arrives.
• Not handling cancelled, failed or timed-out payments.
• Ignoring duplicate callbacks, which can cause double fulfilment.
• Skipping reconciliation, so missing payments go unnoticed for weeks.
• Launching without testing on a slow mobile connection.

Plugin, Payment Gateway or Custom Integration?

You have three realistic routes. A ready-made plugin (for example for WooCommerce) is the fastest option for a simple online shop. A payment gateway bundles M-Pesa with cards and other methods, which is convenient but usually comes with transaction fees. A custom Daraja integration gives you full control over the experience, reporting and automation, and it makes the most sense when payments are tied to your own systems such as a POS, booking platform, school system or mobile app.

If you are weighing the budget for a custom build, our guide on how much it costs to create an app explains what drives the price.

Frequently Asked Questions

Do I need a Paybill or Till number to integrate M-Pesa?

Yes. You can build and test in the sandbox without one, but going live requires a Paybill or Till number linked to your business.

How long does an M-Pesa integration take?

A simple STK Push checkout can be built quickly, but the full timeline depends on testing, your approval process and how much automation you need, such as reconciliation, receipts and reports.

Is STK Push safe for customers?

Customers approve each payment on their own phone with their M-Pesa PIN, so they stay in control. Your responsibility is to protect your credentials, validate callbacks and never ask customers to share their PIN.

Can I add M-Pesa to my existing website or app?

In most cases, yes. WordPress and WooCommerce sites can use a plugin or a custom integration, and custom web or mobile apps can connect to Daraja through their backend.

Does M-Pesa integration help my online visibility?

Not directly, but a smoother checkout improves conversions from the traffic you already earn. Pair it with a solid SEO strategy so more of the right customers reach it.