Most Kenyan customers would rather pay with M-Pesa than with a card. If your website sells products, takes bookings, deposits or school fees, letting people pay with M-Pesa on the spot removes the biggest reason they leave without paying. This guide explains how M-Pesa integration works, what you need before you start and what to check so payments are recorded reliably.

What you need before you start

  • An M-Pesa business account: a Paybill number (customers enter an account number, useful for invoices, fees and orders) or a Buy Goods Till number. Payments go straight to your account, not to the developer.
  • Access to Safaricom’s Daraja portal: Daraja is Safaricom’s developer platform for M-Pesa APIs, at developer.safaricom.co.ke. Your developer builds and tests in its sandbox first.
  • A website with a server-side part: the payment request has to be sent from your server, never from the visitor’s browser, because it uses secret keys.
  • An HTTPS address Safaricom can reach: M-Pesa tells your website whether a payment succeeded by calling a URL on your site.

The main ways to take M-Pesa on a website

M-Pesa Express (STK Push)

This is what most online shops use. The customer enters their phone number at checkout, gets a prompt on their phone with the amount and your business name, and enters their M-Pesa PIN. Nobody has to type a Paybill or account number, so there are fewer mistakes.

Paybill or Till with confirmation

The website shows your Paybill and an account number (for example the order number), the customer pays from their M-Pesa menu, and your website receives a confirmation from Safaricom and matches it to the order. It suits invoices and fees where customers are used to paying by Paybill.

How M-Pesa Express works, step by step

  1. Get an access token. Your server uses the app’s consumer key and secret from Daraja to get a short-lived access token.
  2. Send the payment request. Your server sends the amount, the customer’s phone number, your shortcode, an account reference such as the order number, and a callback URL. The request is signed with a password made from your shortcode, a passkey from Safaricom and a timestamp.
  3. The customer approves on their phone. They see the prompt and enter their PIN, or cancel.
  4. Safaricom calls your callback URL. The result says whether the payment succeeded and, if it did, includes the M-Pesa receipt number, amount and phone number.
  5. Your website updates the order. Only now should the order be marked as paid, a receipt shown and a confirmation sent by email or SMS.

Security and reliability checks

  • Keep keys on the server. The consumer secret and passkey must never appear in the website’s JavaScript or in a public code repository.
  • Trust the callback, not the browser. A customer closing the page doesn’t mean they didn’t pay, and a “thank you” page doesn’t mean they did. Mark orders paid only from Safaricom’s result.
  • Check the amount and reference. Confirm the amount paid matches the order and that each receipt number is recorded once.
  • Handle missing callbacks. Occasionally a callback is delayed; your system should be able to query the transaction status and reconcile against your M-Pesa statement.
  • Log everything. Keep a record of each request and result, so your finance team can answer “I paid but my order says unpaid” quickly.

Going live

After testing in the sandbox, the integration goes through Daraja’s go-live process for your Paybill or Till. The business administrator on the M-Pesa account confirms the request, and Safaricom issues the live credentials. Plan a few days for this in your launch timeline, and run a few small real payments before announcing the new checkout.

What about WordPress, WooCommerce and custom systems?

Plugins exist for WooCommerce and other platforms, and they work well when they’re maintained and configured properly. For bookings, school fees, rent or anything that has to match payments to accounts, a custom integration is often more reliable. Either way, the same rules apply: keys on the server, callbacks as the source of truth, and records your team can reconcile.

Adding SMS confirmations

Customers trust a payment more when they get a confirmation from your business, not only the M-Pesa message. An SMS from your own sender ID with the order number and next steps reduces “did my payment go through?” calls. See transactional SMS.

Need M-Pesa on your website?

We integrate M-Pesa for e-commerce websites, real estate websites taking reservation fees, school websites and custom web applications. Tell us what you need and we’ll quote for it.