To take M-Pesa on your website you need a Safaricom Paybill or Till number, an app on Safaricom's Daraja developer portal, and a website that talks to the Daraja API. The best checkout for most sites is STK Push (M-Pesa Express): the customer enters their phone number, gets a PIN prompt, and your site is told automatically when the payment succeeds. Daraja itself has no sign-up fee; normal M-Pesa transaction charges apply.
In this guide
M-Pesa is how Kenya pays. If customers have to leave your website, open the M-Pesa menu, type a Paybill number and an account and then send you a screenshot, many will give up halfway. Connecting your website directly to M-Pesa turns that into one step: the customer enters their phone number, approves with their PIN, and your site knows instantly that they have paid.
This guide explains how M-Pesa website payments work, what you need from Safaricom, the options available, and the mistakes to avoid — in plain language for business owners, with enough detail to brief a developer.
How M-Pesa payments on a website work
Safaricom gives businesses access to M-Pesa through the Daraja API on its developer portal. An API is simply a secure way for your website to talk to M-Pesa. The most popular checkout method is STK Push, now officially called M-Pesa Express (you may also see it described as Lipa na M-Pesa Online).
- The customer types their M-Pesa number at checkout.
- Your website asks Safaricom, through Daraja, to send a payment request for the exact amount.
- A prompt pops up on the customer's phone showing your business name and the amount. They enter their PIN.
- Safaricom sends the result (paid, cancelled or failed) back to your website's callback URL.
- Your website marks the order as paid and sends a receipt. No screenshots, no manual checking.
What you need before you start
- A Paybill or Till (Buy Goods) number registered to your business with Safaricom.
- Access to your M-Pesa business portal, by someone with administrator rights — needed to approve the "go live" step.
- A Daraja account on developer.safaricom.co.ke, with an app created for your website.
- A website with HTTPS and a server that can receive Safaricom's callbacks. Most good hosting does this.
- A developer to build and test the integration, unless you use a ready-made plugin for your platform.
Paybill or Till: which should you use?
| Paybill | Till (Buy Goods) | |
|---|---|---|
| Best for | Payments that need a reference: invoices, school fees, SACCO contributions, subscriptions | Simple shop-style purchases |
| Account number | Yes — you can use it for an order, invoice or student number | No account field |
| Works with STK Push | Yes | Yes |
| Charges | Standard M-Pesa transaction tariffs apply. Who pays which charge depends on the product and tariff you choose with Safaricom — check the current rates before you decide. | |
The main Daraja APIs explained
Daraja offers several APIs. Most websites only need the first one or two.
- M-Pesa Express (STK Push) — sends the PIN prompt to the customer. The standard choice for online checkouts.
- STK Push Query — lets your site double-check the status of a payment if the callback is delayed.
- C2B (Customer to Business) — for customers who pay manually through the M-Pesa menu. Safaricom notifies your site of each payment to your Paybill or Till, so you can match it to an order automatically.
- B2C (Business to Customer) — sends money out: refunds, salaries, winnings or loan disbursements. Needs extra approval from Safaricom.
- Transaction Status and Reversal — for checking or reversing transactions in your own back office.
Step by step: from sandbox to live payments
- Create a Daraja account and app. You get test keys for the sandbox (a practice environment with test numbers — no real money moves).
- Build the checkout. The developer adds the phone number field, sends the STK Push request, and builds the callback that receives the result.
- Test every outcome in the sandbox: successful payment, wrong PIN, cancelled prompt, phone off, and duplicate attempts.
- Go live. In the Daraja portal, request to take your app live with your real Paybill or Till. The administrator of your M-Pesa business account approves it.
- Swap in the live keys, make a small real payment yourself, and confirm it shows on your M-Pesa statement and in your website's orders.
Common mistakes to avoid
Never mark an order as paid because the customer says so or because a page loaded. Only trust the confirmation that Safaricom sends to your callback URL, and check that the amount and account match the order.
- Ignoring cancellations and timeouts. Customers cancel prompts, enter the wrong PIN or have their phone off. Show a clear "try again" message and let them retry without creating a duplicate order.
- Wrong phone number format. Daraja expects numbers like 2547XXXXXXXX. Accept 07…, +254… and 254… from customers and convert them before sending.
- Keys inside the website code. Store your Daraja keys and passkey in a protected configuration file on the server, never in public code or a shared document.
- No record keeping. Save the M-Pesa receipt number with each order. It is what you need for reconciliation, refunds and disputes.
- Forgetting the manual payers. Some customers will still pay through the M-Pesa menu. C2B notifications or a simple "enter your M-Pesa code" field catches those payments.
Plugins vs a custom integration
If your site runs on a popular platform such as WooCommerce, an M-Pesa plugin can be a quick start. Check that it is maintained, supports STK Push and callbacks properly, and that you understand who holds your keys. For schools, SACCOs, churches and anything with accounts, balances or member records, a custom integration usually fits better because payments have to be matched to the right person and recorded in your own system.
How Elvinsoft can help
We build M-Pesa (Daraja) integrations for online shops, school fee payments, SACCO contributions, church giving and booking systems, with SMS receipts if you need them. You keep your own Paybill or Till, and the money goes straight to your M-Pesa account. See Web Development or ask for a quote.
Frequently asked questions
Do I need a Paybill to accept M-Pesa on my website?
You need either a Paybill or a Till (Buy Goods) number registered to your business. Both work with STK Push. A Paybill suits businesses that need an account reference (such as an invoice or student number); a Till suits simple shop-style payments.
How much does M-Pesa integration cost?
Using the Daraja API has no sign-up fee. You pay normal M-Pesa transaction charges on your Paybill or Till, plus the one-off cost of having a developer build and test the integration into your website or system.
What is STK Push?
STK Push, now called M-Pesa Express, sends a payment prompt straight to the customer's phone. They only enter their M-Pesa PIN; the amount and business are filled in for them. Your website then receives a confirmation from Safaricom.
Can I test M-Pesa payments without real money?
Yes. Daraja has a sandbox with test credentials, so a developer can build and test the whole flow before your live Paybill or Till is connected.
This guide is general information for Kenyan businesses, written by the Elvinsoft team and checked on 31 October 2026. Prices, rules and provider processes change; confirm the details that matter to you before you act.
