If customers keep asking "can I pay via M-Pesa?" and you're sending them to your Paybill manually, you're losing sales every single day.
M-Pesa is how Kenya pays. Over 30 million Kenyans use M-Pesa monthly, and for most SMBs it's the single most important payment method to have on your website. Yet most business websites in Kenya still don't have it properly integrated.
This guide explains exactly how M-Pesa website integration works: what it involves technically, how much it costs, how long it takes, and what you need before you start.
- What "M-Pesa Integration" Actually Means
- Paybill Display vs Real STK Push
- How M-Pesa STK Push Works
- The M-Pesa APIs: STK Push, C2B, B2C, B2B
- STK Push Code Example (Daraja API)
- What You Need Before You Start
- Sandbox to Go-Live Checklist
- How Much Does M-Pesa Integration Cost?
- The Integration Process Step by Step
- How Long Does It Take?
- M-Pesa on WordPress & WooCommerce
- Common Problems & Troubleshooting
- Frequently Asked Questions
What "M-Pesa Integration" Actually Means
There are two very different things people mean when they say "M-Pesa on my website":
Option A: Displaying your Paybill/Till number: Your developer puts your Paybill number on the website. Customers copy it, open their M-Pesa app, and pay manually. You receive no automatic confirmation, no order update, nothing. Takes 30 minutes, costs almost nothing.
Option B: Real M-Pesa STK Push integration: A customer clicks "Pay with M-Pesa", enters their phone number, and immediately receives a push notification on their phone. They enter their PIN, payment goes through, and your website automatically confirms the order. This is real integration.
If you want to run a proper online business, especially an e-commerce shop, you need Option B.
Paybill Display vs Real STK Push
| Feature | Paybill Display | STK Push Integration |
|---|---|---|
| Customer experience | Manual (they initiate) | Seamless (push notification) |
| Auto payment confirmation | ❌ No | ✅ Yes |
| Auto order processing | ❌ No | ✅ Yes |
| Receipt sent automatically | ❌ No | ✅ Yes |
| Reduces abandoned payments | ❌ No | ✅ Yes |
| Development required | ❌ No | ✅ Yes |
How M-Pesa STK Push Works on a Website
Here's what happens from the customer's perspective when STK Push is properly integrated:
- Customer selects items and clicks "Pay with M-Pesa"
- They enter their phone number (e.g. 0712 345 678)
- Immediately, they receive a push notification on their phone
- They enter their M-Pesa PIN to confirm
- Payment is processed in 3–10 seconds
- Your website automatically confirms the order
- Customer sees "Payment Successful" screen
- Automated receipt sent to both customer and your email
Behind the scenes, this uses Safaricom's Daraja API, the official M-Pesa API that connects your website to the M-Pesa network.
The M-Pesa APIs: STK Push, C2B, B2C, B2B
The Daraja API is not one thing. It is a family of endpoints, and knowing which one you need saves time and money. Most website integrations use STK Push, but the others matter for specific businesses.
| API | Direction | Use it for |
|---|---|---|
| STK Push (Lipa Na M-Pesa Online) | Customer → You | The two-tap checkout. Best for e-commerce, bookings, donations, any online payment. |
| C2B (Customer to Business) | Customer → You | Confirming manual Paybill or Till payments. Safaricom sends your site a callback so orders auto-confirm without SMS forwarding. |
| B2C (Business to Customer) | You → Customer | Automated payouts: refunds, salaries, marketplace seller payouts, loan disbursement, winnings. |
| B2B (Business to Business) | You → Business | Paying suppliers or moving funds from your Paybill to another company's Paybill. |
| Transaction Status / Reversal | Query | Checking whether a payment went through, or reversing a wrong transaction. |
For a typical Kenyan business website that just needs to collect payments, STK Push (plus a C2B confirmation fallback) is all you need. If you also need to send money out automatically, you add B2C.
STK Push Code Example (Daraja API)
To show you what "integration" actually involves under the hood, here is the core of an STK Push request. Every integration has two moving parts: (1) get an access token, then (2) send the STK Push. This is simplified PHP using cURL, the same flow works in any language.
Step 1 — Get an OAuth access token
Step 2 — Trigger the STK Push to the customer's phone
Safaricom then pushes the PIN prompt to the customer's phone. When they pay, Safaricom sends the result to your CallBackURL, and that is where the real work lives: verifying the result code, matching it to the order, marking it paid, sending the receipt, and logging everything. Getting that callback handling right, with proper error handling and duplicate protection, is what separates a working integration from one that silently loses payments. It is also why we test every integration with real KES 1 transactions before going live.
What You Need Before You Start
1. A Registered Safaricom Business Account
You need either a Paybill number or a Buy Goods / Till number. If you don't have one yet, register at safaricom.co.ke or visit a Safaricom Business Centre.
2. A Safaricom Daraja Developer Account
Your developer registers at developer.safaricom.co.ke to get API credentials. This is free.
3. API Credentials from Safaricom
Once approved, you'll receive a Consumer Key, Consumer Secret, Passkey, and your Shortcode. This takes 3–10 business days with Safaricom.
4. A Kenyan Registered Business
Your Safaricom business account must be registered to a valid Kenyan business. Personal M-Pesa accounts cannot be used for website integrations.
Sandbox to Go-Live Checklist
Every Daraja integration is first built and tested in Safaricom's sandbox (a fake environment with test credentials), then promoted to production (real money). This is the step where most DIY integrations get stuck, because the sandbox behaves differently from live. Here is the exact path:
- Create a Daraja app (sandbox): Sign in at developer.safaricom.co.ke, create an app, and copy the sandbox Consumer Key and Secret.
- Build against the sandbox shortcode: Use test shortcode 174379 and the sandbox passkey to build and debug the STK Push flow.
- Expose a public HTTPS callback: Safaricom must be able to reach your CallBackURL. On localhost, tunnel it (e.g. ngrok); in production it must be a live HTTPS URL.
- Test every outcome: success, wrong PIN, insufficient funds, user cancel, and timeout. Your callback handler must deal with all of them.
- Apply to Go Live: In the Daraja portal, submit the "Go Live" form with your real Paybill/Till, business shortcode and organisation details (this is the KYC step).
- Receive production credentials: Safaricom issues live Consumer Key, Secret and production passkey. Swap them in and point URLs to
api.safaricom.co.ke. - Run a real KES 1 transaction: Never announce launch off sandbox alone. Push one real shilling through the live Paybill and confirm the money lands and the order updates.
- Turn on logging and monitoring: Log every request and callback so you can trace any future payment dispute.
How Much Does M-Pesa Integration Cost in Kenya?
There are three separate costs people confuse. Let's separate them clearly:
| Cost | Typical amount (KES) | Notes |
|---|---|---|
| Safaricom Daraja API access | Free | Registering and using the API costs nothing. |
| M-Pesa transaction charges | Per Safaricom tariff | Standard Lipa Na M-Pesa charges apply per payment received. Set by Safaricom, not your developer. |
| Developer integration (one-off) | ~15,000 – 60,000 | Depends on platform and how much custom logic (payouts, reconciliation, subscriptions) you need. |
| WPfoss M-Pesa integration | 1,000 / year | All-inclusive for adding M-Pesa to an existing site: STK Push, Paybill, Till, payouts and ongoing support. |
A basic STK Push checkout on an existing WordPress or WooCommerce site sits at the lower end. A custom system with automated reconciliation, B2C payouts and subscription billing sits at the higher end. If you want a fixed number for your exact setup, see our M-Pesa integration service in Kenya, or just tell us what you are running.
The Integration Process Step by Step
Here's how WPfoss handles an M-Pesa integration project:
Setup & Credentials
Client applies for Safaricom API access (we help with this). Developer registers on Daraja. Sandbox environment set up for testing. Initial integration built using test credentials.
Development & Testing
STK Push flow implemented and tested. Payment confirmation (callback URL) set up. Order status updates connected. Automated receipt emails configured. Edge cases tested: failed payments, timeouts, duplicate requests.
Go Live
Production API credentials received. Switch from sandbox to live. Real transaction testing with small amounts (KES 1). Monitoring set up. Handover and documentation.
How Long Does It Take?
The development itself takes 5–10 business days. The variable is Safaricom. Getting live API credentials can take 3 business days to 3 weeks depending on your business documents and current processing times.
Our advice: Start the Safaricom application process before you even brief your developer. That way, by the time development is done, credentials are ready.
M-Pesa on WordPress & WooCommerce
Most Kenyan business websites run on WordPress, and most online shops run on WooCommerce, so this is the most common M-Pesa integration we do. There are two routes:
Plugin route: A WooCommerce M-Pesa plugin adds "Pay with M-Pesa" as a checkout option. It is quick, but many free plugins are abandoned, insecure, or route payments through a third party that takes a cut. If you go this way, use a maintained plugin and confirm the money lands in your Paybill, not the plugin author's.
Custom route: We wire the Daraja API directly into WooCommerce's checkout and order system. Orders move to "Processing" automatically on a confirmed callback, receipts fire, and there is no third party in the middle. This is more robust and fully yours. We cover the shop-specific details in our guide to WooCommerce M-Pesa integration in Kenya.
Either way, the underlying Daraja flow is identical to what is described above; WooCommerce just gives it a checkout button and an order to update.
Common Problems & Troubleshooting
- Developer uses their own Safaricom credentials: Always verify the integration uses your Paybill/Till, not theirs.
- No error handling for failed payments: When a customer's payment fails, the site should let them retry gracefully.
- Callback URL not working: If Safaricom can't reach your callback URL, your site never confirms payment even when money was received. Test this thoroughly.
- Sandbox vs production confusion: Always test with a real KES 1 transaction before announcing the site is live.
- No transaction logs: Log every M-Pesa attempt. Without logs, troubleshooting payment issues is nearly impossible.
Frequently Asked Questions
How much does M-Pesa integration cost in Kenya?
A one-off developer integration typically runs KSh 15,000 to KSh 60,000 depending on your platform and how much custom logic is involved. WPfoss adds M-Pesa to an existing website for KSh 1,000 per year, all-inclusive. Safaricom does not charge for Daraja API access, but standard M-Pesa transaction charges apply per payment. See our M-Pesa integration service for a fixed quote.
How long does M-Pesa integration take?
Development takes about 5 to 10 business days. The variable is Safaricom go-live approval, which can take 3 business days to 3 weeks. Start the Safaricom application before development so credentials are ready when the build is done.
Can I add M-Pesa to any website?
Yes. M-Pesa STK Push can be integrated into any website, including custom HTML/PHP, React, or any other technology. Your website must have a live HTTPS server for the callback URL to work.
Do I need a Paybill number for M-Pesa integration?
Yes. For business M-Pesa integrations, you need either a registered Paybill or Buy Goods (Till) number from Safaricom. Personal M-Pesa accounts cannot be used.
What is the Safaricom Daraja API?
The Daraja API is Safaricom's official developer platform allowing businesses to integrate M-Pesa into websites, apps, and systems. Access it at developer.safaricom.co.ke.
Is M-Pesa integration safe for customers?
Yes. The STK Push process is secured by Safaricom's infrastructure. Your website never handles, stores, or sees the customer's M-Pesa PIN.
Want M-Pesa on your website?
WPfoss has integrated M-Pesa into dozens of Kenyan business websites. See our M-Pesa integration service in Kenya for what is included, or get in touch and we'll tell you exactly what it involves for your site.
See M-Pesa Integration Service