Payments · 6 min read
How to accept M-Pesa payments on your website (STK Push explained)
How M-Pesa STK Push works, what you need from Safaricom Daraja, and how to go live safely.
Short answer
To accept M-Pesa online, businesses use Safaricom’s Daraja API, usually “M-Pesa Express” (STK Push). Your website sends a payment request, the customer gets a PIN prompt on their phone, and Safaricom sends your server a confirmation. You need a Paybill or Till number and Daraja API credentials.
What is M-Pesa STK Push?
STK Push (branded M-Pesa Express) is a payment request that appears on the customer’s phone asking them to enter their M-Pesa PIN. The customer never has to type your Paybill number or account reference, which reduces errors and abandoned payments.
What do you need to accept M-Pesa online?
- A Safaricom Paybill or Till (Buy Goods) number
- A Daraja developer account and an app with M-Pesa Express enabled
- Consumer key, consumer secret and a passkey (sandbox first, then production)
- A website or app backend that can call the API securely
- A public HTTPS callback URL to receive payment confirmations
How does an M-Pesa payment flow work?
- The customer chooses M-Pesa at checkout and enters their phone number.
- Your server requests an access token from Daraja, then sends the STK Push request with the amount and reference.
- The customer receives a PIN prompt and approves the payment.
- Safaricom sends the result (success or failure, receipt number, amount) to your callback URL.
- Your system checks the amount, marks the order paid and sends a receipt.
How do you keep M-Pesa payments secure?
- Never trust the browser, confirm payment on your server via the callback or the status query API
- Check the amount paid matches the order
- Keep API keys in server environment variables, never in website code
- Use a secret, hard-to-guess callback URL and HTTPS
- Make order updates idempotent so duplicate callbacks don’t double-process
How long does it take to go live?
Building and testing in the Daraja sandbox can take a few days. Going live requires submitting a Go Live request in the Daraja portal for your Paybill or Till; Safaricom then issues production credentials.
Red Star builds M-Pesa checkouts into websites, apps and SaaS products, including Paystack, Flutterwave and card payments for international customers.
Frequently asked questions
Can I accept M-Pesa without a Paybill?
For automated online payments you need a Paybill or Till number linked to Daraja. Payment gateways such as Paystack and Flutterwave can also accept M-Pesa on your behalf.
What is the difference between Paybill and Till for online payments?
Paybill payments include an account reference and suit invoices and subscriptions; Till (Buy Goods) suits simple retail payments. Both work with STK Push using the correct transaction type.
Related services
E-commerce DevelopmentOnline stores that convert, with AI selling and local payments built in.Node.js DevelopmentScalable backends, integrations and AI services.PHP & Laravel DevelopmentCost-effective business apps, new builds or modernisation.