How to accept M‑Pesa payments on your website

For most Kenyan customers, paying online means paying with M-Pesa. If your website can't take M-Pesa, many visitors will leave rather than look for another way to pay.

This guide explains the options, how a proper M-Pesa checkout works, and what to watch out for. It's written for business owners, not developers, so there's no code.

Three ways businesses take M-Pesa online

1. Show a till number and ask for a screenshot

This is where many businesses start. The website shows a till or paybill number, the customer pays from their phone, then sends a screenshot or the M-Pesa message on WhatsApp.

It costs nothing to set up, but it doesn't scale:

• Someone has to check every payment by hand.
• Customers mistype amounts or account numbers.
• Fake screenshots and edited messages are a real risk.
• Orders sit waiting until someone is free to confirm them.

2. Connect directly to Safaricom with the Daraja API

Daraja is Safaricom's API for businesses. The most useful part for a website is Lipa na M-Pesa Online, usually called STK Push.

With STK Push, the customer enters their phone number at checkout, gets a payment prompt on their phone, and enters their M-Pesa PIN. They never have to type a till number or an amount, so there's much less room for mistakes.

This gives you the most control and no middleman, but it needs a developer to set up and maintain.

3. Use a payment gateway

Gateways such as Paystack and Pesapal sit between your website and the payment networks. One integration lets customers pay with M-Pesa or a card.

Gateways are often quicker to set up and handle cards as well as M-Pesa, which matters if you sell to customers outside Kenya. In return, they charge their own fees on top of the payment network's, and your money passes through them before it reaches you.

We've built checkouts on all three of Daraja, Paystack and Pesapal. The right choice depends on who your customers are and how you want to receive your money.

How an STK Push checkout works

Here's what happens behind the scenes when a customer pays:

1. The customer adds items to their cart and enters their M-Pesa number at checkout.
2. Your website asks Safaricom to send a payment prompt to that number, for the exact order amount.
3. The customer sees the prompt on their phone and enters their PIN.
4. Safaricom processes the payment, then sends the result to a secure address on your server, called a callback URL.
5. Your server checks the result, marks the order as paid, and sends a confirmation.

The important part is step 4. The payment is only confirmed when Safaricom tells your server it went through, not when the customer's browser says so. A well-built checkout also handles the cases where things go wrong: the customer cancels, enters the wrong PIN, doesn't have enough balance, or the callback is delayed.

What you need before you start

To use the Daraja API with your own business number, you'll need:

• A Lipa na M-Pesa till number or paybill registered to your business.
• A Safaricom Daraja account, where your developer creates and tests the integration in a sandbox before going live.
• Approval to go live, which you request through the Daraja portal once testing is done. Safaricom then issues the production credentials.
• A website with a secure server that can receive the callback. A website hosted as plain pages with no server behind it can't do this on its own.

If you use a gateway instead, you sign up with the gateway, complete their business verification, and they handle the connection to Safaricom.

Mistakes to avoid

• Trusting the browser. If your site marks an order as paid because the checkout page said "success", it can be fooled. Only the confirmation from Safaricom or your gateway counts.
• Not saving the transaction details. Store the M-Pesa receipt number and amount with each order. You'll need them for refunds, disputes and your accounts.
• Ignoring failed and pending payments. Customers should see a clear message and a way to try again, not a page that spins forever.
• Forgetting about reconciliation. At the end of the month, your orders and your M-Pesa statement should match. A good dashboard makes this a five-minute job instead of an afternoon.

What it costs

On a business website, adding online payments with M-Pesa typically costs KES 15,000 to 30,000 with us, depending on how payments connect to bookings, orders or invoices. A full online store with M-Pesa checkout, order management and an admin dashboard starts at KES 130,000. You'll also pay transaction fees to Safaricom or your gateway on each payment.

You can get a range for your own project with our cost estimator, or see what's included in an online store with M-Pesa.

The goal: payments you never have to check

When M-Pesa is set up properly, a customer pays and the order appears in your dashboard already confirmed. Nobody has to compare screenshots with statements, and nobody has to chase a payment at 10pm.

If you're still confirming payments by hand, tell us how you sell today and we'll suggest the simplest way to automate it.