M-Pesa (Daraja) integration
Use Safaricom's Daraja API through NunuaPay to push an M-Pesa payment prompt to a customer's phone and confirm the result server-side.
What this integration supports
- Methods
- M-Pesa mobile money (STK push).
- Currency
- KES.
- Country
- Kenya (KE).
- Checkout
- No hosted URL. The customer acts on their phone.
- Webhooks
- Daraja posts a result callback. NunuaPay re-verifies before completing the payment.
- Refunds
- Not supported by this integration.
How to configure it
- Add an M-Pesa (Daraja) account under Providers for your business.
- Enter the Daraja credentials (consumer key/secret, shortcode, passkey) for the sandbox or production environment.
- Ensure the callback URL NunuaPay exposes is reachable from Safaricom.
Payment initiation flow
- Create a payment intent with
method: "mobile_money"and the customer’s phone number. - NunuaPay requests an STK push via Daraja and receives a checkout request ID.
- The customer enters their M-Pesa PIN to confirm the payment.
- Safaricom posts the result to NunuaPay, which verifies it and notifies your endpoint.
Callbacks and verification
The Daraja result callback is not a trust boundary on its own. NunuaPay matches the callback to the stored payment attempt (by checkout request ID and provider reference) and reconciles the status before applying the outcome.
Testing
Daraja exposes a sandbox with test shortcodes and credentials. Run the sandbox flow end-to-end before switching to production credentials.