How to Integrate M-Pesa Express (STK Push) Into Your Website

This article is part of our Ultimate Guide to Digital Transformation for Kenyan SMEs.

M-Pesa Express, often called STK Push, lets a customer pay by simply entering their phone number on your website and confirming a prompt on their phone. No copying paybill numbers, no typing amounts, no waiting for a screenshot. For businesses selling online, it is one of the biggest conversion improvements available in Kenya.

How the payment flow works

1. The customer enters their phone number at checkout
2. Your server asks Safaricom's Daraja API to send a payment prompt
3. The customer enters their M-Pesa PIN on their phone
4. Safaricom sends a confirmation to your server's callback address
5. Your system marks the order or invoice as paid automatically

What you need before you start

• A registered Paybill or Till number
• A Safaricom Daraja developer account and production approval
• A website or system with a secure server (HTTPS) to receive callbacks
• A clear record of orders or invoices to match payments against

Security matters

Never trust the browser to confirm payment. Only the callback from Safaricom, verified on your server, should mark something as paid. API credentials must stay on the server and never be placed in website code that visitors can see.

Test properly

Daraja provides a sandbox for testing. Test successful payments, cancelled prompts, wrong PINs, timeouts and duplicate callbacks before going live.

Common pitfalls

• Not handling the case where the customer ignores the prompt
• Missing callbacks because the server address changed
• No reconciliation report to compare with M-Pesa statements

Need help?

We build M-Pesa integrations as part of our system integrations and web development services. Talk to us about your checkout.