M-PESA Integration for Kenyan Websites: Complete 2026 Guide (Daraja API)

M-PESA integration lets customers pay directly on your website using Safaricom's Daraja API. STK push integration costs KES 10,000-25,000 to develop and takes 3-7 days. This guide covers everything: how it works, what it costs, the setup process, and code examples for developers.

What Is M-PESA Daraja API?

Daraja API is Safaricom's official API for integrating M-PESA payments into websites and mobile apps. It replaced the old NOP (Nyota Online Payments) system in 2018 and is now the standard for all M-PESA web integrations in Kenya. Daraja supports STK push (customer gets a prompt on their phone), C2B (customer sends money to your paybill), and B2C (you send money to customers).

How M-PESA STK Push Works

STK push (Sim Tool Kit push) is the most popular M-PESA integration method. Here is the customer journey:

• Customer visits your website and adds items to cart
• At checkout, customer enters their M-PESA phone number
• Your website calls the Daraja API to initiate an STK push
• Customer receives a prompt on their phone asking to enter M-PESA PIN
• Customer enters PIN, payment is processed instantly
• Daraja API sends a callback to your website confirming payment
• Your website shows 'Payment successful' and updates the order

The entire process takes 5-15 seconds. The customer never leaves your website. This is why STK push has the highest conversion rate of any payment method in Kenya.

M-PESA Integration Costs in Kenya

Total one-time cost: KES 10,000-30,000. Total ongoing cost: KES 5,000-20,000/year for hosting and SSL. There are no per-transaction fees from Safaricom for Daraja API (unlike payment aggregators like Pesapal which charge 2.5-3.5% per transaction).

Requirements for M-PESA Integration

Before you can integrate M-PESA, you need:

• A Safaricom Daraja API account (register at developer.safaricom.co.ke - free)
• An M-PESA shortcode (Paybill or Till number). If you don't have one, register at Safaricom shops.
• A website with HTTPS (SSL certificate). Daraja API requires HTTPS for security.
• A server that can receive callbacks (webhooks) from Safaricom.
• A developer who knows JavaScript/Node.js or PHP.

Step-by-Step M-PESA Integration Process

Step 1: Register on Safaricom Daraja portal. Go to developer.safaricom.co.ke and create an account. You will get a Consumer Key and Consumer Secret. These are your API credentials.

Step 2: Create a Safaricom C2B shortcode. If you already have a Paybill or Till number, use it. If not, visit a Safaricom shop with your business registration documents to get one. This costs KES 0-5,000 depending on the type.

Step 3: Set up your callback URLs. These are HTTPS endpoints on your server that Safaricom will call when a payment is confirmed. You need two: one for success callbacks and one for timeout/failed payments.

Step 4: Generate an access token. Use your Consumer Key and Secret to get a temporary access token from the Daraba API. This token expires every hour and must be refreshed.

Step 5: Initiate STK push. When a customer checks out, call the Daraja STK push endpoint with the customer's phone number, amount, and your shortcode. Safaricom sends the prompt to the customer's phone.

Step 6: Handle the callback. When the customer pays, Safaricom calls your callback URL with the transaction details. Verify the payment and update your order in the database.

M-PESA Integration Code Example (Node.js)

Here is a simplified example of initiating an STK push using Node.js and the Daraja API. In production, you should use environment variables for secrets and add proper error handling.

First, get an access token: POST to https://sandbox.safaricom.co.ke/oauth/v1/generate with your Consumer Key and Secret encoded in Basic Auth. Then, POST to https://sandbox.safaricom.co.ke/mpesa/stkpush/v1/processrequest with the BusinessShortCode, Password, Timestamp, TransactionType, Amount, PartyA (customer phone), PartyB (your shortcode), PhoneNumber, CallbackURL, and AccountReference. Safaricom responds with a CheckoutRequestID and the customer gets the STK prompt.

For the callback, create a POST endpoint on your server that receives the transaction result. Check the ResultCode (0 = success) and update your database accordingly. Always verify the callback is genuinely from Safaricom by checking the security credentials.

Common M-PESA Integration Mistakes

• Not using HTTPS: Daraja API rejects HTTP requests. You must have an SSL certificate.
• Hardcoding credentials: Never put your Consumer Key/Secret in client-side code. Always server-side.
• Not handling timeouts: If a customer doesn't respond in 60 seconds, the STK push expires. Handle this gracefully.
• Not verifying callbacks: Always verify that callback requests are genuinely from Safaricom. Fake callbacks can fraudulently mark orders as paid.
• Not testing in sandbox: Always test in the Daraja sandbox (sandbox.safaricom.co.ke) before going live. Use test phone numbers provided by Safaricom.
• Forgetting to refresh tokens: Access tokens expire every hour. Implement automatic refresh logic.

M-PESA Integration vs Payment Aggregators

You have two options for M-PESA integration: direct Daraja API (what we described above) or payment aggregators like Pesapal, Jenga, or DPO Pay. Here is the comparison:

If you process more than KES 100,000/month in M-PESA payments, direct Daraja API is cheaper (you save the 2.5-3.5% transaction fee). For smaller volumes, an aggregator is simpler.