M-Pesa Payment Integration for Websites in Kenya: Complete Ecommerce Guide for 2026–2027

M-Pesa is one of the most important payment methods for Kenyan online customers. An ecommerce website that accepts M-Pesa can reduce checkout friction by allowing customers to pay from their phones.

Proper integration is more than displaying a Till or Paybill number. A complete system connects the order, payment request, Safaricom result and final status so the store knows which order was actually paid.

Afix Smart Web develops online stores through its ecommerce website packages and website design services.

What Is M-Pesa Integration?

M-Pesa integration connects a website or application to Safaricom’s payment APIs. The system can initiate a prompt, receive transaction notifications, validate the result and update an order.

Safaricom’s Daraja platform provides access to M-Pesa APIs for web and mobile applications. Developers can create an account, test in a sandbox and complete the process for production.

Common Payment Approaches

Approach	How It Works	Suitable Use
Manual Till or Paybill	Customer pays separately and submits a code.	Small stores with manual confirmation.
M-Pesa Express / STK Push	Website sends a prompt to the phone.	Automated ecommerce checkout.
C2B notifications	System receives payment information.	Paybill or Till reconciliation.
Payment gateway	Third party offers M-Pesa and other methods.	Several payment options.

How STK Push Works

1. Customer adds products or services to the cart.
2. Checkout collects the phone number and order details.
3. Website sends a secure request through the API.
4. Customer receives a phone prompt.
5. Customer enters the M-Pesa PIN on the phone.
6. Safaricom sends a result to the callback URL.
7. Website verifies the result and updates the order.
8. Customer receives confirmation.

What the Business Needs

• A business or individual setup meeting onboarding requirements.
• An appropriate Till, Paybill or shortcode arrangement.
• A Daraja developer account.
• A website using HTTPS.
• A secure server-side application or ecommerce platform.
• A public callback URL.
• An order database and reference system.
• Payment, refund, privacy and delivery policies.

Sandbox and Production

The sandbox lets developers simulate requests without real customer money. It tests authentication, initiation, callbacks, errors and order updates.

Production uses live credentials and transactions. Credentials should never be exposed in front-end code, public repositories, screenshots or shared documents.

Custom Integration Versus Plugin

Custom Integration

Custom development gives control over the payment flow, callbacks, reporting and order logic. It suits specialised systems but requires stronger maintenance.

WooCommerce Plugin or Gateway

A maintained plugin can reduce development time. Review the provider, updates, support, security, compatibility and callback handling. Do not install several overlapping payment plugins from unknown sources.

Why the Callback Matters

The browser response should not be treated as final proof of payment. A customer can close the page, lose internet or receive a delayed prompt. The server callback should be matched to the order.

Store the merchant request ID, checkout request ID, order number, amount, result code, transaction reference and timestamps required for reconciliation.

Failed, Cancelled and Delayed Payments

• Show a clear pending status.
• Do not mark paid merely because a request was sent.
• Allow a safe retry without duplicate orders.
• Tell the customer when to wait.
• Provide a support route.
• Reconcile completed transactions.
• Log errors without exposing credentials.

Security Requirements

• Use HTTPS.
• Keep credentials on the server.
• Restrict administrator access.
• Validate callback data and amounts.
• Use unique references.
• Protect logs and personal information.
• Keep software updated.
• Back up the store and records.
• Test refunds and support procedures.
• Monitor unusual activity.

Use Cases

Website Type	Typical Need
Ecommerce	Pay for products and update orders.
School	Pay fees, applications or events.
Travel	Pay deposits or bookings.
Property	Pay booking fees or deposits.
Service business	Pay invoices or retainers.
Membership	Pay renewals where supported.

M-Pesa and Merchant Center

A store can use M-Pesa at checkout while promoting eligible products through Google Merchant Center. Prices, availability, delivery and landing pages should remain accurate. Afix Smart Web provides Google Merchant Center support.

What Changes the Integration Cost?

Development cost depends on the platform, shortcode, checkout design, order logic, reporting, testing and other gateways. Safaricom or gateway transaction charges and onboarding requirements are separate from development fees.

Request a scope showing sandbox testing, production setup, callback handling, WooCommerce configuration, confirmation messages, reconciliation and post-launch support.

Common Mistakes

• Calling a displayed phone number full automation.
• Marking orders paid before confirmation.
• Putting credentials in public code.
• Using HTTP.
• Failing to match the amount.
• No process for delayed payments.
• Using an abandoned plugin.
• Not testing mobile checkout.
• Keeping no transaction logs.
• No refund or support information.

Frequently Asked Questions

1. Does the customer enter the PIN on the website?

No. The PIN is entered on the phone prompt.

2. Can any number receive STK Push?

The number must be valid and eligible for the request.

3. Can M-Pesa work with WooCommerce?

Yes, through a suitable plugin, gateway or custom integration.

4. Is a Till number enough?

It accepts payments, but automated order confirmation needs integration.

5. Can the website accept cards too?

Yes. Several gateways can be offered.

6. What happens when the customer cancels?

The order remains unpaid and a safe retry can be offered.

7. Do I need Daraja?

Direct API integration uses Safaricom’s developer platform.

8. Can I test without real money?

Yes. Use the sandbox.

9. Does Afix Smart Web build stores?

Yes. Ecommerce design, products and payment integration can be combined.

10. How do I request a quote?

Prepare the platform, shortcode type and desired flow, then contact Afix Smart Web.

How to Apply This Guide in a Real Business

Begin by documenting the current situation before changing anything. Record the website address, account owners, active services, current errors, customer complaints and the result the business wants. This creates a baseline for M-Pesa payment integration and ecommerce checkout and prevents several people from making conflicting changes.

Assign one responsible person inside the business to keep ownership information, renewal dates, passwords, invoices and support contacts organised. External developers may handle technical work, but the online business should still understand which accounts exist and who controls them.

Make changes in a logical order. Correct eligibility, security or technical access problems before spending money on advertising. Improve the most important commercial pages before publishing many new blogs. Test the complete customer journey on a mobile phone, including calls, WhatsApp, forms, checkout and confirmation messages.

Questions to Ask a Developer or Service Provider

• Which accounts and documents must the business own?
• What exact work is included and what remains the client’s responsibility?
• How will the changes be tested before going live?
• What can interrupt the website, email, payments or Google visibility?
• How will backups and recovery be handled?
• Which results can be measured after implementation?
• What information must the business provide?
• What ongoing maintenance is required?
• What happens when the service provider relationship ends?
• Which costs renew monthly or yearly?

Avoid providers who guarantee permanent rankings, guaranteed Google reinstatement or completely risk-free security. A professional provider explains the process, limitations, evidence and ongoing responsibilities. The business should receive clear access and documentation instead of depending on one person’s private account.

A 30-Day Learning and Implementation Plan

Period	Main Action	Expected Outcome
Days 1–5	Audit current accounts, pages, settings and documents.	The business understands the real problem.
Days 6–10	Correct urgent access, accuracy or security issues.	Major risks and blockers are removed.
Days 11–20	Implement the technical and content improvements.	The website or profile becomes stronger and easier to use.
Days 21–25	Test on mobile and desktop and review customer actions.	Errors are found before wider promotion.
Days 26–30	Measure results, document access and plan maintenance.	The business has a repeatable process.

The final step is documentation. Save the account owner, renewal date, responsible contact, support process and a short record of every important change. Good documentation reduces downtime and makes future website work faster and safer.

Final Thoughts

A reliable integration confirms real payments, protects credentials and keeps checkout simple. The business also needs accurate products, delivery rules and support after payment.

Combine the store with digital marketing services only when fulfilment and tracking are ready.

Official Resources

• Safaricom Daraja Developer Portal
• M-Pesa Express API
• Safaricom API catalogue

How to Measure Progress Without Guessing

After implementing the recommendations in this M-Pesa payment integration website Kenya guide, record the results in a simple monthly report. Include the date of each change, the person responsible, the account or page affected and the outcome. This prevents the business from repeating failed experiments and makes future troubleshooting faster.

Use measurements that match the real goal. A technical task may be measured through successful verification, fewer errors, faster recovery or completed transactions. A marketing task should also be connected to calls, WhatsApp enquiries, quotation requests, purchases or bookings. Impressions and clicks are useful diagnostic numbers, but they are not the final business result.

What to Record	Why It Matters
Date and description of change	Shows what may have influenced the result.
Account owner and access level	Prevents ownership and recovery confusion.
Errors before and after	Confirms whether the technical issue improved.
Customer actions	Connects the work to enquiries or sales.
Renewal and maintenance date	Prevents future interruption.
Supporting documents and backups	Speeds up recovery and verification.

What Business Owners Should Keep in a Digital Asset Register

Create a secure record of the domain registrar, hosting provider, website administrator, Google accounts, payment accounts, social profiles, business email and backup locations. Record who owns each account, which company email is used, when the service renews and who should be contacted during an emergency.

Do not place passwords in an ordinary spreadsheet shared with many people. Use a reputable password manager and give team members only the access required for their roles. The register should show that an account exists and who controls it without exposing sensitive credentials to everyone.

• Domain registrar and renewal date.
• Hosting provider and support contact.
• WordPress administrator owners.
• Google Business Profile owners and managers.
• Search Console and analytics access.
• M-Pesa or payment integration contacts.
• Business email administrator.
• Backup location and last successful restore test.
• Theme and plugin licences.
• Developer or agency support agreement.

When Professional Support Is Worth the Cost

A business owner can learn the basic concepts and still decide to use professional support. The decision should be based on risk, complexity, time and the cost of interruption. A simple information update may be handled internally, while account restrictions, payment callbacks, malware removal, migrations and DNS changes can affect several systems at once.

Professional support is most valuable when the provider explains the work, documents the result and leaves the business with proper ownership. Avoid arrangements where the company cannot access its domain, website, payment system or Google accounts without one individual.

Before approving work, request the scope, required information, expected timeline, testing method, exclusions and post-completion support. This protects both the business and the service provider and makes the result easier to evaluate.