How to Integrate M-Pesa Into Your Website (2026): STK Push, Daraja API and Payment Gateways

Photo: M-PESA mobile money and Equity agent, Nairobi, Kenya by wrcomms, CC BY-SA 2.0. Cropped.

Why M-Pesa on your website matters

For Kenyan customers, M-Pesa is the default way to pay. A website that only offers "send money to this number and WhatsApp us the code" loses customers at the last step and creates manual matching work for your team. An integrated checkout lets customers pay in seconds, confirms the order automatically and records the payment against the right customer, which is essential for e-commerce, bookings, deposits and invoices.

What you need before you start

1. A registered business and KRA PIN.
2. A Safaricom Till (Buy Goods) or Paybill in the business name. Paybill is better if customers pay invoices or need an account reference.
3. A website on HTTPS with a server that can receive callbacks (not a static site with no backend).
4. A developer account on Safaricom's Daraja portal, if you integrate directly.

Route 1: Direct Daraja API integration (STK Push)

STK Push ("Lipa na M-Pesa Online") is what Kenyan shoppers expect: they enter their phone number, a prompt appears on their phone, they enter their PIN, and the website confirms the payment.

How it works, step by step

1. Create an app on the Daraja portal to get a consumer key and secret, and get your shortcode and passkey from Safaricom when you go live.
2. Get an access token: your server requests an OAuth token from Daraja (valid for about an hour) using the key and secret.
3. Send the STK Push request with the amount, the customer's phone number, your shortcode, a timestamp, an encoded password and a callback URL, plus an account reference such as the order number.
4. The customer enters their PIN on their phone.
5. Safaricom calls your callback URL with the result: success with an M-Pesa receipt number, or a failure such as a cancelled prompt or insufficient funds.
6. Your server marks the order paid, saves the receipt number, and the page updates for the customer.

Pros and cons

• Pros: smoothest checkout, no gateway fees on top of M-Pesa charges, full control, payments land directly in your till or paybill.
• Cons: needs a developer, server-side code, careful handling of callbacks, timeouts and edge cases, and Safaricom's go-live approval.

Route 2: Payment gateways

Gateways such as Paystack, Pesapal, Flutterwave and DPO offer M-Pesa plus Visa/Mastercard through one integration, often with ready-made WooCommerce and Shopify plugins.

Many stores use both: Daraja STK Push for M-Pesa and a gateway for cards.

M-Pesa on WordPress and WooCommerce

WooCommerce has several M-Pesa plugins (some direct Daraja, some via gateways). Before installing one, check it is actively maintained, supports STK Push with callback confirmation, handles failed and duplicate callbacks, and comes from a reputable developer. Avoid nulled (pirated) plugins entirely: payment code is the last place you want malware. On Shopify, M-Pesa usually comes through third-party payment apps or gateways.

Paybill account numbers for invoices and fees

If customers pay invoices, school fees, rent or instalments, use a Paybill with an account number (invoice number, admission number, plot number). Daraja's C2B API sends each payment to your system, which matches the account number to the customer automatically. That's what makes reconciliation automatic. See our guide to M-Pesa reconciliation.

Security essentials

• Never mark an order paid from the browser. Only Safaricom's or the gateway's server-side callback is proof. For extra safety, confirm with a transaction status query.
• Keep keys secret: consumer secret and passkey in server configuration, never in front-end code or public repositories.
• Protect the callback URL with HTTPS and a secret token, and reject anything that doesn't match an expected pending payment.
• Make callbacks idempotent: the same receipt number must never be counted twice.
• Log every transaction securely. Payment records contain personal data covered by the Data Protection Act.

Testing before launch

1. Build and test in the Daraja sandbox with test credentials.
2. Test failure cases: cancelled prompt, wrong PIN, timeout, duplicate callback.
3. Apply for go-live, switch to production keys and your live shortcode.
4. Make several small live payments (e.g. KES 10) and confirm the receipt numbers match.
5. Check that confirmation emails or WhatsApp messages reach customers.

How much does M-Pesa website integration cost?

Costs have three parts: development (from a plugin setup to a custom Daraja integration with reconciliation), Safaricom's transaction charges (which vary by till or paybill and agreement, so confirm current tariffs with Safaricom), and any gateway fees. In our estimator, M-Pesa payments with automatic reconciliation are a $300 add-on to a website, and they're included in our e-commerce builds.

Common problems and fixes

Designing a checkout customers trust

The integration is only half the job; the checkout screen decides whether people complete payment. Show the total in shillings, explain that a prompt will appear on their phone, pre-fill their number if they're logged in, and show a clear "Waiting for your M-Pesa PIN…" state that updates automatically when payment confirms. Offer a fallback ("Pay to Paybill 123456, account INV-0042") if the prompt doesn't arrive. These small details noticeably reduce abandoned payments.

USD prices and M-Pesa

M-Pesa transactions are in shillings. If your prices are in dollars, as for export products or international services, convert to KES at checkout using a published rate and round up, then store the payment in both currencies for your books. Show the customer the KES amount before the PIN prompt to avoid surprises.

Beyond checkout: what integrated M-Pesa unlocks

• Deposits for bookings (salons, clinics, venues, site visits) that reduce no-shows.
• Invoices with a "Pay with M-Pesa" button, so clients pay the moment they open the invoice.
• Instalment plans for plots, school fees or large projects, with automatic reminders.
• Live revenue dashboards that show collections as they happen.

Our own CRM uses exactly this flow: quotes accepted online become invoices with M-Pesa STK Push, and payments mark themselves paid.

Who should build your integration?

If you run WooCommerce with modest volume, a reputable plugin set up by your web developer is usually enough. If payments are central to your business (instalments, invoices, high volumes or several channels), invest in a proper Daraja integration with reconciliation and reporting, built by a developer who has shipped M-Pesa systems before and can show you live examples.

Next step

If you sell online, take deposits or send invoices, integrated M-Pesa pays for itself quickly in saved admin and fewer lost sales. See our e-commerce website design service, or talk to us about adding M-Pesa to your existing site.

Frequently asked questions

Explore Kavenacc services & pricing →