The short answer: M-Pesa integration connects your website to Safaricom's Daraja API. Customers pay through an STK Push prompt or a C2B flow, and your system receives a callback to confirm the transaction. The valuable work is validating payments, reconciling records and handling failures.
Two common flows
| Flow | How it works | Best for |
|---|---|---|
| STK Push | Customer enters a phone number, receives a prompt, and approves payment | Checkout, invoices, bookings |
| C2B | Customer pays to a paybill or till number and the system receives confirmation | Donations, deposits, retail payments |
What the integration needs
- A verified Daraja account and production credentials.
- A secure server endpoint for callbacks and validation.
- Idempotency so duplicate callbacks do not double-credit an order.
- Reconciliation between the payment record and the order or invoice.
- Clear failure messages and a manual fallback.
- Logging that protects customer data.
Security rules
Never trust a client-side success message. Confirm the payment server-side using the callback and, where needed, a status query. Store only the reference and the minimum customer data you need. Keep credentials out of frontend code. Restrict admin access and audit refunds.
Common mistakes
- Showing "paid" before the callback confirms it.
- No retry or reconciliation process.
- Assuming every timeout is a failure. Some payments complete late.
- No manual path when the API is down.
- No support process for customers who paid but did not receive confirmation.
We build payment flows as part of website development and software products. See the Safari Yetu case study for a booking and portal build.
Frequently asked questions
How long does M-Pesa integration take?
A straightforward STK Push flow usually takes one to three weeks once the Daraja account is approved. Reconciliation, refunds and reporting add time.
How much does integration cost in Kenya?
A basic checkout integration commonly starts around KES 40,000 to KES 120,000 depending on the platform, order flow and reporting. Custom reconciliation or multi-branch logic costs more.
Can we integrate M-Pesa without a developer?
Some plugins exist, but they often fail on reconciliation, callbacks and security. Use a plugin only if it matches your flow and you can test failure cases.
Do we need a paybill or till number?
Yes for C2B. STK Push also requires an approved shortcode and Daraja credentials. Start the Safaricom application early; approval is the usual delay.
Next step: if you are planning payments, send us the checkout flow and order states.