To accept M-Pesa on your website you need three things: a Safaricom business shortcode (a Paybill or a Till), a developer account on Safaricom’s Daraja portal to get your API credentials, and a website that can send a payment request and receive Safaricom’s confirmation. Once approved, customers pay by entering their phone number, receiving a prompt on their handset and typing their PIN. They never leave your site.
If you sell anything online in Kenya, M-Pesa is not optional. Asking a customer to fetch a card, or worse to send money manually to a till number and then WhatsApp you a screenshot, loses sales at the exact moment someone has decided to buy. Proper integration removes that friction entirely.
This guide explains what is involved in plain language, written for business owners rather than developers, so you know what you are buying and what to ask for.
What M-Pesa Integration Actually Means
There is an important difference between displaying a till number and integrating M-Pesa.
- Displaying a number means the customer leaves your site, opens the M-Pesa menu, pays manually, and then tells you they have paid. You reconcile it by hand. Mistakes and disputes are common, and many customers abandon the purchase.
- Integration means your website talks directly to Safaricom. The order is created, payment is requested, Safaricom confirms it automatically, and the order is marked paid without anyone touching a spreadsheet.
The connection is made through Safaricom’s official API platform, Daraja. That is the only legitimate route, and any provider offering M-Pesa on your site will be using it.
Paybill or Till: Which Do You Need?
Before any development happens you need a business shortcode from Safaricom Business. Which one depends on how you sell.
| Option | Best for | Account reference |
|---|---|---|
| Paybill | Orders, invoices, subscriptions and anything you need to match to a specific customer | Yes, customers enter an account number |
| Till (Buy Goods) | Straightforward retail sales where the amount is the whole story | No account number |
For most online stores a Paybill is the safer choice, because the account reference lets you tie each payment to an order number automatically. If you already trade with a Till, integration is still possible. Talk to Safaricom about which product suits your business before applying, since changing later is more work than choosing correctly at the start.
How STK Push Works for Your Customer
The feature you actually want is called Lipa na M-Pesa Online, better known as STK push. From the customer’s side it looks like this:
- They reach checkout and choose M-Pesa.
- They enter their phone number and press pay.
- A prompt appears on their handset showing your business name and the amount.
- They enter their M-Pesa PIN.
- Safaricom notifies your website, which marks the order paid and sends confirmation.
The whole thing takes seconds and the customer never leaves your website. That is the entire point, and it is why integrated stores convert better than stores that display a till number.
What You Need Before You Start
Have these ready, because the paperwork usually takes longer than the coding:
- A registered business with the documents Safaricom asks for, which typically include your certificate of registration, KRA PIN and the identification of the business owners or directors.
- A Paybill or Till shortcode issued to that business.
- A Daraja developer account, which is free to create.
- Your API credentials: a consumer key, a consumer secret, your shortcode and a passkey.
- A website on HTTPS with a valid certificate. Safaricom sends payment confirmations to a callback address on your site, and that address must be secure and publicly reachable.
That last requirement catches people out. If your certificate is broken or your site is not properly reachable, confirmations fail and orders sit unpaid even though the customer’s money has left their account.
The Integration Process, Step by Step
- 1. Apply for the shortcode. Done directly with Safaricom, with your business documents.
- 2. Create a Daraja account and register an application to obtain your consumer key and secret.
- 3. Build and test in the sandbox. Daraja provides a test environment so payments can be simulated safely before real money moves.
- 4. Connect the callback. Your site exposes a secure address that Safaricom notifies when a payment succeeds or fails. This is what makes reconciliation automatic.
- 5. Go live. Credentials are switched from sandbox to production and Safaricom confirms your setup.
- 6. Test with real money. Always run a genuine low value transaction before announcing that you accept payments.
A competent developer handles steps two to six. Step one is yours, and it is usually the slowest.
How Long It Takes
The development work is not the bottleneck. For a straightforward store, connecting M-Pesa is typically a matter of days once credentials are in hand.
Getting the shortcode approved is what determines your launch date, and that commonly runs to several weeks depending on how complete your paperwork is and what sector you trade in. Businesses in regulated sectors face additional checks. Start the Safaricom application early, in parallel with the website build, rather than waiting until the site is finished.
What It Costs
There are two separate costs, and providers sometimes blur them:
- Safaricom’s charges. Transaction and service charges are set by Safaricom, not by your developer. Confirm the current rates directly with them, since tariffs change and you should budget from the official figures rather than a blog post.
- Development. A one-off cost to build and test the connection. On our own ecommerce development packages, M-Pesa integration is included rather than billed as an extra, and our guide to website costs in Kenya sets out the wider budget.
Common Mistakes to Avoid
- Registering the shortcode under a personal name. It should belong to the business, or you create ownership problems later.
- Letting the developer hold your credentials. Your consumer key, secret and passkey belong to you. Keep your own copy.
- Skipping the failure cases. Customers cancel prompts, enter wrong PINs and run out of balance. The site must handle all three gracefully rather than leaving the order stuck.
- No reconciliation check. Occasionally a confirmation does not arrive. A good build queries the transaction status rather than assuming silence means failure.
- Never testing after launch. Payment flows break quietly after updates. Test yours monthly, the same way you should be testing your contact form.
- Announcing before a live test. Always push one real shilling through before you tell customers you accept M-Pesa.
Do You Need a Developer?
For the Safaricom application, no. Any business owner can apply for a Paybill or Till.
For the integration itself, realistically yes. It involves authentication tokens, encrypted passwords generated from your passkey and a timestamp, a secure callback endpoint and proper handling of failed payments. If you use a common platform there are plugins that shorten the work, but they still need configuring, securing and testing, and a badly configured plugin that loses payment confirmations is worse than no integration at all.
We build M-Pesa checkout into the online stores we deliver, including the Fahavi Computers store you can see on our portfolio page. If your current store is live but not converting, our guide on why websites stop producing enquiries covers the other usual culprits.
Want M-Pesa Working on Your Store?
Tell us what you sell and whether you already have a Paybill or Till, and we will tell you what is involved, how long it will take and what it will cost. If you only need the integration rather than a new site, say so and we will quote for that alone.
Request a free consultation or see our ecommerce development packages.
Frequently Asked Questions
How do I add M-Pesa to my website in Kenya?
You need a Safaricom Paybill or Till shortcode registered to your business, a free developer account on Safaricom’s Daraja portal to obtain your API credentials, and a developer to connect your site so it can request payments and receive confirmations. The site must run on HTTPS with a valid certificate for Safaricom’s confirmations to reach it.
What is STK push?
STK push, officially Lipa na M-Pesa Online, is the prompt that appears on a customer’s phone asking them to confirm a payment with their M-Pesa PIN. It lets someone pay without leaving your website, which is why integrated checkouts convert better than displaying a till number.
Should I use a Paybill or a Till number?
A Paybill is usually better for online stores because it accepts an account reference, letting you match each payment to an order automatically. A Till suits simple retail sales where you do not need to identify what the payment was for. Confirm with Safaricom which product fits your business before applying.
How long does M-Pesa integration take?
The development work is often only a few days once credentials are available. Getting the shortcode approved by Safaricom is the slower part and commonly takes several weeks depending on your paperwork and sector, so start that application early.
Can I accept M-Pesa without a registered business?
Business shortcodes are issued to registered businesses, and you should not run commercial payments through a personal number. Register the business properly, both because Safaricom requires it and because it keeps ownership of the shortcode with your company.
What does M-Pesa integration cost?
There are two costs: Safaricom’s own transaction and service charges, which you should confirm directly with Safaricom as tariffs change, and a one-off development cost to build and test the connection. Some providers include the integration in an ecommerce build rather than charging separately.
What happens if a customer cancels the payment prompt?
A well built integration marks the order unpaid and lets the customer try again, rather than leaving it stuck or wrongly marking it complete. Cancelled prompts, wrong PINs and insufficient balance are normal and should all be handled cleanly.
Can I add M-Pesa to an existing website?
Usually yes, provided the site runs on HTTPS and is built on a platform that can be extended. You do not always need a rebuild. Ask your developer to quote for the integration on its own before assuming a new site is necessary.