How to Accept M-Pesa Payments on Your Website in Kenya

Most Kenyan customers would rather pay with M-Pesa than enter a card number online. If your business website only accepts cards or bank transfers, you are asking customers to take an extra step, and many will leave before they finish. Adding M-Pesa checkout to your website is one of the most practical upgrades a Kenyan business can make.

This guide explains how M-Pesa payments work on a website, what you need before you start, and how to avoid the mistakes that cause failed or unconfirmed payments.

How M-Pesa Website Payments Work

The most common method for online M-Pesa payments is STK Push, also called Lipa Na M-Pesa Online. Here is the basic flow:

1. The customer enters their phone number on your checkout page and confirms the order. 2. Your server sends a request through the Safaricom Daraja API asking M-Pesa to send a payment prompt to that phone. 3. The customer receives a pop-up on their phone and enters their M-Pesa PIN to approve the payment. 4. Safaricom sends the result of the transaction to a callback URL on your server. 5. Your website marks the order as paid, or as failed, based on that result.

The key point is that the customer never sends money to a number they have to type in manually. The prompt does the work, which reduces errors such as wrong amounts or missing account references.

What You Need Before You Start

Before writing any code, gather the following:

• A Safaricom Paybill or Till number registered for business use. Your Paybill or Till is what receives the money.
• A Daraja developer account at the Safaricom developer portal, where you create an app and get a consumer key and consumer secret.
• The Lipa Na M-Pesa Online passkey and your shortcode, which are linked to your business account.
• A server with HTTPS. Safaricom must be able to reach your callback URL over a secure connection. A callback on a local laptop or an unsecured address will not work in production.
• A backend that can make secure server-to-server calls. Never place your consumer secret or passkey in frontend JavaScript where visitors can see it.

Start in the Daraja sandbox. It lets you test the full flow with test credentials and simulated phone numbers before real money is involved. Moving to production requires Safaricom's go-live process, so plan for that time in your launch schedule.

Building the Integration

A typical integration has three backend pieces.

1. Get an access token. Daraja uses OAuth. Your server sends your consumer key and secret to the authentication endpoint and receives a temporary access token. Cache the token and refresh it when it expires rather than requesting a new one for every payment.

2. Send the STK Push request. Your server builds a request containing the business shortcode, the transaction type, the amount, the customer's phone number in the international format (254 followed by nine digits), an account reference such as the order number, a short transaction description, and your callback URL. The password field is built by combining the shortcode, the passkey, and a timestamp, then encoding the result in Base64. Daraja's documentation includes the exact format, and following it carefully prevents most authentication errors.

3. Handle the callback. When the customer completes or cancels the payment, Safaricom posts the result to your callback URL. Your endpoint should:

• Check that the `ResultCode` is 0 for success.
• Match the `CheckoutRequestID` or `MerchantRequestID` to the pending order in your database.
• Confirm the amount matches what you expected.
• Save the M-Pesa receipt number and mark the order as paid.
• Return a success response quickly, and move any slow processing, such as sending emails or updating inventory, to a background job.

It is also wise to build a query endpoint that checks the status of a transaction. Callbacks can occasionally be delayed or missed, so a scheduled check on orders stuck in a pending state keeps your records accurate.

Making the Checkout Work for Customers

The technical integration is only half the job. The customer experience determines whether people complete their payment.

• Tell customers what to expect. Display a message such as "You will receive an M-Pesa prompt on your phone. Enter your PIN to complete payment." Many customers are confused when a prompt appears and they do not know whether to act.
• Show a clear waiting state. After the request is sent, show a status screen that updates when the callback arrives, rather than leaving the page blank.
• Handle cancellations and timeouts. If a customer dismisses the prompt or does not respond, let them retry easily without creating duplicate orders.
• Validate phone numbers. Accept common formats such as 07XX, 01XX, and +254, then convert them to the 254 format before sending.
• Send receipts. Email or SMS the M-Pesa receipt number and order details so customers have proof of payment.

Security and Common Mistakes

A few errors cause most problems with M-Pesa website payments:

• Trusting the STK Push response alone. That response only confirms the request was received. The actual payment outcome comes from the callback or a status query.
• Marking orders paid before confirmation. Always wait for a successful result code.
• Exposing credentials. Store consumer keys, secrets, and passkeys in environment variables on the server.
• Ignoring duplicate callbacks. Make your callback handler idempotent so the same payment cannot be recorded twice.
• Skipping logs. Log every request and callback with timestamps. When a customer says they paid, these logs are the fastest way to find out what happened.
• Using a test shortcode in production. Double-check your environment settings before going live.

When to Bring in Help

You can build an M-Pesa integration in-house if you have a developer comfortable with server-side APIs. However, payment flows touch money and customer trust, so mistakes are costly. At Mycrea, we typically handle the Daraja setup, callback reliability, order reconciliation, and testing as part of a broader e-commerce or web application build. That includes connecting M-Pesa to your inventory, invoicing, and customer notifications so the payment is not a standalone feature.

If your business already runs on a website, adding M-Pesa checkout is usually faster and cheaper than most owners expect, especially when the integration is planned from the start.

Final Checklist

Before you go live, confirm that:

• Your Paybill or Till and passkey are correct for production.
• Your callback URL uses HTTPS and is publicly reachable.
• Credentials are stored securely on the server.
• Successful, failed, and cancelled payments are each tested.
• Orders update correctly when callbacks are delayed.
• Customers receive a receipt and clear instructions.

M-Pesa can make your website feel local and trustworthy to Kenyan buyers. With a careful setup, it can also reduce abandoned checkouts and give your team reliable payment records from day one.