M-Pesa on Your Website: What Daraja Integration Involves

Daraja is Safaricom's bridge to M-Pesa. It's the gateway for developers to integrate M-Pesa into applications. Your website talks to Daraja. Daraja talks to Safaricom. A customer pays. Done. No redirects, no payment aggregator markup, just M-Pesa on your site.

The catch is that it's not a checkbox you click. Safaricom does not issue production Daraja credentials to individuals — you need a registered business entity. And the technical bits matter: if your callback URL dies, payments look successful to the customer but fail on your end. Money gets stuck. That's the kind of problem nobody wants to debug at 2am.

What Daraja Actually Does

STK Push (also called Lipa na M-Pesa Online) is the most commonly used endpoint. It lets your application trigger a payment prompt on a customer's phone without requiring them to enter your paybill or till number manually. They get a prompt on their phone. They enter their PIN. Your website gets the result instantly via a callback.

Daraja API is Safaricom's official API for integrating M-Pesa payments into websites and mobile apps. It replaced the old NOP (Nyota Online Payments) system in 2018 and is now the standard for all M-Pesa web integrations in Kenya.

What You Need to Start

First: Daraja developer account. Go to developer.safaricom.co.ke, click "Sign Up" and create an account with your email, verify your email and log in. This is free. You get sandbox credentials instantly — test phone numbers, a test shortcode, and a passkey you can use without spending money.

Second: A registered business and M-Pesa business account. You need an active M-Pesa business account (Paybill or Till Number). If you don't have one, apply for the business M-Pesa account first through Safaricom Business, wait for it to be activated, then apply for Daraja production access. This takes time. Safaricom's business team moves slowly.

Third: A publicly reachable HTTPS endpoint for callbacks. Daraja API requires HTTPS for security. When a customer pays, Safaricom sends the result back to a URL you control. If that URL is dead or non-HTTPS, Safaricom can't tell you the payment succeeded. Use Let's Encrypt for a free certificate.

Fourth: A developer. To integrate it you create an app on the Daraja portal to get a Consumer Key and Secret, exchange those for a short-lived OAuth access token, then call the right payment API for your use case. If you're not comfortable with APIs and JSON, hire a payment integration expert to do this properly. A cheap integration now can cost you thousands in lost payments later.

The Integration Path: Sandbox to Live

Step 1: Test in sandbox. The Daraja sandbox is free for development and testing. Sandbox credentials are free and available instantly. This is where you learn how the API works. Use test numbers. Don't risk real money.

Step 2: Build your callback handler. Your server sends an STK Push request to Daraja with the customer's phone number and amount. Safaricom sends a push prompt to the customer's phone. The customer enters their M-Pesa PIN (or cancels). Safaricom sends the result to your callback URL. Your server processes the callback and updates the order/transaction status. That last step — processing the callback reliably — is where most integrations break.

Step 3: Apply for production credentials. Going live on Daraja requires a registered Kenyan business, KRA compliance, production API credentials from Safaricom, a valid SSL certificate on your callback URLs, proper error handling, and a reconciliation strategy. Most applications get rejected for incomplete business documentation or invalid callback URLs. Budget 2 to 10 business days for the full approval process.

Step 4: Go-live testing. Safaricom's team will test your integration against their production environment. They'll check failure cases: what happens if the customer cancels, times out, or enters the wrong PIN. Get this right.

The Costs

The Daraja sandbox is free for development and testing. For production, there is no API usage fee from Safaricom, but M-Pesa charges transaction fees on each payment, typically 0-1% depending on the transaction type and amount.

For development, you'll pay between KES 15,000 and 60,000 to a developer, depending on complexity. Your hosting needs HTTPS, which costs between KES 5,000 and 15,000 per year. Those are the only recurring costs. No monthly subscriptions. No per-request charges to Safaricom.

The big trade-off: direct Daraja integration is cheaper than payment aggregators like PesaPal (which charge 2.5–3.5% per transaction), but it requires more technical work and more setup time.

Common Mistakes

No HTTPS callback URL. Safaricom rejects non-HTTPS callbacks. Get a certificate from Let's Encrypt. It's free and takes 10 minutes.

Callback handler that doesn't handle retries. Safaricom may send the same callback multiple times if your server doesn't acknowledge it instantly. Store the result once, idempotently. If you process it twice, your customer double-pays.

Not testing timeouts and failures. The customer's phone will be unreachable sometimes. Their M-Pesa will be suspended sometimes. The network will drop sometimes. Build for that.

Wrong phone number format. Daraja expects the international format without the plus sign: 254XXXXXXXXX. A Kenyan number. Always.

When to Use Daraja, When to Use Something Else

Use direct Daraja if: you only need M-Pesa, your developer knows REST APIs, and you want the lowest transaction fees. Use a payment aggregator like PesaPal or Flutterwave if: you need M-Pesa plus card payments in one checkout, you want faster setup, or you'd rather pay a small percentage per transaction to avoid the technical headache.

For WordPress, there are plugins like WooCommerce M-Pesa Gateway that wire Daraja in without coding. The plugin handles the callbacks for you. This matters if your developer isn't deep in the weeds.

If you're not sure, talk to a Kenyan expert who's done this before. They know the gotchas.

Frequently Asked Questions

How long does production approval take?

If your documents are complete and clear, approval typically comes within 2 to 3 business days. But incomplete paperwork or a bad callback URL can extend it to weeks. Get everything right the first time.

Do I need a Kenyan business to use Daraja?

Safaricom does not issue production Daraja credentials to individuals. You need a registered business entity. You can test in sandbox without a business. To go live, no exceptions.

What if my callback URL fails?

Your customer sees "payment approved" on their phone. You never get the callback. The money sits in Safaricom's system. You lose it. Whitelisting your callback URL on the Daraja portal and monitoring it obsessively is not optional.

Can I use Daraja from outside Kenya?

Yes, the API is accessible from anywhere. However, the customer making the payment must have a Safaricom M-Pesa account (Kenyan phone number starting with 254). Your server can be anywhere. Your customers must be in Kenya.