M-PESA e-commerce setup guide: STK Push checkout for Kenyan online stores

Most Kenyan shoppers would rather pay with M-PESA than type in a card number. A good online store makes that a two-tap experience: the customer taps Pay, an M-PESA prompt appears on their phone, they enter their PIN, and the order is marked paid automatically. Here is how that works and what you need.

The three ways people "accept M-PESA" online

1. Manual Paybill or Till instructions. The site shows "Pay to Till 123456" and the customer sends a screenshot or code. Cheap, but slow and easy to fake. You reconcile everything by hand.
2. A payment gateway (for example Pesapal, Paystack, Flutterwave or IntaSend). The gateway handles M-PESA and cards for you and charges a fee per transaction. Fastest route for many stores.
3. Direct Safaricom Daraja integration. Your site talks to Safaricom's Daraja API directly. More setup, but no gateway in the middle for M-PESA.

What STK Push is

STK Push (officially Lipa Na M-PESA Online) lets your website send a payment request to the customer's phone. They see the amount and your business name, enter their PIN, and Safaricom sends the result back to your server.

The flow looks like this:

1. Customer enters their phone number at checkout and taps Pay.
2. Your server requests an access token from Daraja, then sends the STK Push request with the amount, phone number, your shortcode and a callback URL.
3. The customer gets the prompt and enters their PIN.
4. Safaricom calls your callback URL with the result: success with an M-PESA receipt number, or a failure reason (cancelled, insufficient funds, timeout).
5. Your store marks the order paid, emails or SMSes a receipt, and notifies you, for example on WhatsApp.

What you need before going live

• A registered Paybill or Till number (Buy Goods) in the business's name.
• A Daraja developer account at developer.safaricom.co.ke. Build and test in the sandbox first.
• A public HTTPS callback URL on your site that can receive Safaricom's result.
• Go-live approval. Through the Daraja portal you link your app to your real shortcode. The business administrator on the M-PESA account usually has to confirm.

Mistakes we see often

• Trusting the front end. Only mark an order paid after the callback confirms it, never because the customer clicked "I have paid".
• Not storing receipts. Save the M-PESA receipt number, amount and phone against each order for reconciliation and refunds.
• Ignoring timeouts. If the customer doesn't respond, the request expires. Show a clear "try again" option and use the transaction status query.
• Phone format errors. Normalise numbers to the 2547XXXXXXXX format before sending.
• No test with real money. After go-live, run a few small real payments before launch.

Do you also need cards?

If you sell to diaspora customers, tourists or companies, yes. Card payments usually go through a gateway. Many stores run M-PESA via Daraja and cards via a gateway side by side.

Beyond STK Push

• C2B lets you receive payments customers start themselves to your Paybill, with automatic confirmation to your system.
• B2C lets your platform pay out to phones, for example refunds, commissions or creator payouts.

Costs

Safaricom charges business tariffs on M-PESA transactions according to its published rates, and gateways add their own fees. Build cost depends on the store. Our e-commerce with M-PESA stores start at KES 65,000, and adding STK Push to an existing site is KES 18,000.

Want orders to arrive in WhatsApp too? See WhatsApp chatbots for Kenyan businesses.