How do I take M-Pesa payments on my website?
Updated
You need a Safaricom business number — a Till (Buy Goods) or a Paybill — and then one of three set-ups. The simplest prints the number on the page; the best sends the payment prompt straight to the customer’s phone and marks the order paid by itself. That second one is built on Safaricom’s Daraja API, and it is what makes a website feel like a shop rather than a brochure.
Start with the business number
Every online M-Pesa payment lands in a business shortcode. A Till number (Buy Goods) suits a shop that sells to walk-in and online customers alike. A Paybill suits a business that needs an account reference on each payment — an invoice number, a student number, a meter number — because the customer types it and it comes back with the money.
Either works for the methods below. Apply through Safaricom; you will need the business registration documents and a KRA PIN.
The three ways, from simplest to best
They differ in how much the customer has to type and how much your staff have to check.
| Method | What the customer does | Who confirms the payment | Fits |
|---|---|---|---|
| Number on the page | Opens M-Pesa, types the till or paybill, the amount and the PIN | A person, reading the SMS | A few orders a week |
| STK Push (M-Pesa Express) | Enters a phone number on the site, then only the PIN on the prompt | The system, automatically | Any shop taking orders daily |
| Payment confirmation (C2B) | Pays the till or paybill as usual | The system, from Safaricom’s notification | Paybills with account numbers |
STK Push and C2B confirmation are both offered through Safaricom’s Daraja developer portal and can run side by side on one shortcode.
What STK Push actually involves
When a customer clicks pay, your server asks Safaricom to send a payment prompt to their phone. They enter their PIN, and Safaricom calls your server back with the result. The order is marked paid without anyone reading an SMS.
To go live you need Daraja credentials for your shortcode (a consumer key, a consumer secret and a passkey), a server that can receive Safaricom’s callback over HTTPS, and Lipa na M-Pesa Online enabled on the shortcode by Safaricom. Build and test against the Daraja sandbox first, then move the same code to production.
- The prompt only arrives on a phone that is on and unlocked — offer the plain till or paybill as a fallback.
- Never mark an order paid because the customer clicked a button. Only Safaricom’s callback proves the money arrived.
- Keep the credentials on the server. A key in a web page is a key anyone can read.
Which one should a small business choose?
If orders arrive a few times a week, a till number on the page and a WhatsApp confirmation is honest and costs nothing to build. Once someone is spending part of every day matching SMS messages to orders, STK Push pays for itself: it removes the checking, the typing errors and the “I have paid, check again” calls.
Questions people ask
- Do I need a Paybill, or will a Till number work?
- Either works for STK Push. Choose a Paybill when every payment needs an account reference, such as an invoice number; a Till is simpler for a shop.
- Does Safaricom charge for using the Daraja API?
- Registering on the Daraja portal and calling the API is free. The normal M-Pesa transaction charges for your till or paybill still apply.
- Can M-Pesa payments work on a WhatsApp shop as well?
- Yes. The same STK Push can be triggered from a WhatsApp order, so the customer orders in the chat and pays from a prompt on the same phone.
