How Does M-Pesa STK Push Work for Websites and Apps?

M-Pesa has become an important payment option for many businesses operating in Kenya. But asking customers to manually send money to a PayBill or Till number and then confirm the transaction can create unnecessary steps, especially when payments need to be connected to an online order, booking, invoice or customer account.

This is where M-Pesa STK Push integration becomes useful.

With STK Push, a website, mobile application or other business system can initiate an M-Pesa payment request and send a payment prompt directly to a customer's mobile phone.

The customer reviews the request and authorizes the transaction using their M-Pesa PIN.

Behind that apparently simple interaction is an automated communication process involving the business application, its backend, Safaricom's M-Pesa APIs and the customer's phone.

Safaricom provides M-Pesa APIs through its Daraja developer platform, which is designed to connect M-Pesa services with web and mobile applications.

Let's look at how the process works.

What Is M-Pesa STK Push?

M-Pesa STK Push is a payment process in which a business system initiates a payment request that causes an M-Pesa prompt to appear on the customer's supported mobile device.

Instead of requiring the customer to manually open M-Pesa, choose a payment option and type all the payment information, much of the transaction information can already be supplied by the business system.

The customer primarily needs to review the request and authorize the transaction.

Safaricom describes this flow as an organization initiating a C2B payment request and sending an STK Push to the target customer's phone.

This makes STK Push useful for websites and applications where the business already knows information such as the amount being paid and the order or account associated with the transaction.

A Simple Example

Imagine a customer is purchasing a product from an online store.

The order costs:

KSh 3,500

At checkout, the customer chooses:

Pay with M-Pesa

They enter their phone number and click:

Pay Now

The process can then look like this:

Customer ↓ Website / Mobile App ↓ Business Backend ↓ Safaricom M-Pesa API ↓ STK Push sent to customer's phone ↓ Customer reviews request ↓ Customer enters M-Pesa PIN ↓ M-Pesa processes transaction ↓ Callback sent to business backend ↓ Business verifies result ↓ Order/payment record updated ↓ Customer receives confirmation

From the customer's perspective, the process may take only a few interactions.

The technical work happens largely behind the scenes.

How Does M-Pesa STK Push Work Step by Step?

Let's break the process down.

Step 1: The Customer Starts a Transaction

The process normally begins on the business's website or mobile application.

The customer may be:

• Buying a product
• Paying an invoice
• Booking a service
• Paying school fees
• Purchasing an event ticket
• Paying a deposit
• Renewing a subscription
• Paying for a delivery
• Funding an account
• Paying for another eligible service

The system determines the amount that should be paid.

For example:

Order: RT-1045 Amount: KSh 3,500 Payment method: M-Pesa

The customer then provides or confirms their M-Pesa phone number.

Step 2: The Website or App Sends the Request to Its Backend

A secure implementation should not expose sensitive M-Pesa API credentials directly in browser or mobile client code.

Instead, the frontend sends the required transaction information to the application's backend.

For example:

Customer phone number + Payment amount + Order/reference ↓ Application backend

The backend can validate the request before communicating with the M-Pesa API.

This is important because the business should control the transaction from a trusted server-side environment.

Step 3: The Backend Authenticates With the M-Pesa API

Before making the appropriate M-Pesa API request, the application must authenticate according to Safaricom's API requirements.

Safaricom's Daraja platform provides developers with access to M-Pesa APIs and a sandbox environment where applications can be developed and tested before production use.

Authentication credentials and other sensitive configuration should be protected on the server rather than exposed publicly.

Step 4: The Backend Initiates the STK Push

Once the backend is ready, it sends the required payment information to the appropriate M-Pesa Express/STK Push endpoint.

The request identifies information needed for the transaction, such as the customer, amount, business shortcode/account context, transaction reference and callback destination according to the API specification.

Safaricom's integration documentation describes the business setting the transaction information and sending the request before the API validates it and acknowledges the request.

The important point is that the business system initiates the payment request.

The customer doesn't have to manually construct the payment from scratch.

Step 5: The Customer Receives the M-Pesa Prompt

After the request has been accepted for processing, an STK Push request is sent to the target customer's phone.

The customer sees an M-Pesa payment prompt.

They can review the transaction and choose whether to authorize it.

Safaricom's integration documentation notes that the customer's phone needs to be online and able to receive the STK request.

Step 6: The Customer Enters Their M-Pesa PIN

If the customer wants to continue, they enter their M-Pesa PIN on the M-Pesa interface.

An important security distinction is:

The customer's M-Pesa PIN should not be entered into the merchant's website or application.

The business system initiates the payment, but PIN authorization occurs through the M-Pesa interaction presented to the customer.

The website therefore does not need to collect the customer's M-Pesa PIN.

Step 7: M-Pesa Processes the Transaction

If the customer authorizes the request correctly, M-Pesa processes the payment.

However, not every STK Push request results in a successful transaction.

A transaction may fail or be cancelled for reasons such as:

• Customer cancellation
• Incorrect PIN
• Insufficient funds
• Timeout
• Invalid transaction information
• Technical problems
• Another incompatible transaction state

Safaricom's integration documentation specifically describes outcomes including invalid PIN, timeout, customer cancellation and situations where another STK transaction is already underway.

The business application must therefore be designed for both successful and unsuccessful outcomes.

Step 8: M-Pesa Sends the Result to the Callback URL

This is one of the most important parts of the integration.

When initiating the payment, the business provides a callback URL.

After processing the transaction, the M-Pesa system can send the transaction result to that backend endpoint.

Conceptually:

M-Pesa ↓ https://yourbusiness.co.ke/api/payments/mpesa/callback ↓ Business backend

Safaricom's documentation explains that the transaction result is forwarded to the callback URL specified in the original request.

The backend can then interpret the result and update the relevant business record.

Step 9: The Business Updates the Order or Payment

Suppose the customer was paying for order:

RT-1045

Before payment:

Order: RT-1045 Amount: KSh 3,500 Payment status: PENDING

After the system receives and validates a successful payment result, it could become:

Order: RT-1045 Amount: KSh 3,500 Payment status: PAID M-Pesa reference: [transaction reference]

The system can then automatically trigger the next business process.

For example:

Payment successful ↓ Order marked PAID ↓ Receipt generated ↓ Customer notified ↓ Fulfilment begins

This automation is one of the major benefits of integrating M-Pesa directly into a business system.

Safaricom notes that M-Pesa API integration can support real-time automated reconciliation between M-Pesa transactions and internal business systems, reducing manual processes.

Step 10: The Customer Receives Confirmation

Once the payment has been confirmed by the backend, the website or application can show an appropriate status.

For example:

Payment Successful Your payment has been received. Order: RT-1045

The business could also send confirmation through an appropriate channel such as email, SMS or an in-app notification depending on its system.

The important principle is that the application should rely on a trustworthy server-side transaction result rather than simply assuming that a payment succeeded because an STK request was sent.

What Happens If the Customer Cancels the STK Push?

Customers are not forced to complete an STK Push request.

They may cancel the transaction.

If that happens, the business system should handle the unsuccessful result appropriately.

For example:

Payment not completed. You cancelled the M-Pesa payment request. Try Again

The order might remain:

Payment status: PENDING

rather than being marked as paid.

What Happens If the Customer Doesn't Enter Their PIN?

STK Push requests don't remain open indefinitely.

If the customer does not respond within the allowed period, the request can time out.

Safaricom's published integration documentation describes timeout as one possible negative outcome of the process.

The application should therefore handle timeout states gracefully and, where appropriate, allow the customer to try again.

What If the Callback Doesn't Reach the Website?

A production payment system should not assume that callbacks will always arrive successfully.

Networks and servers can experience temporary problems.

Safaricom's integration documentation notes that failed callbacks are not repeatedly called in the described STK Push flow and points to transaction-status querying as a way to confirm transaction status.

That means a robust integration should have a strategy for reconciling transactions whose final state is uncertain.

This is especially important because a payment system must avoid situations where:

M-Pesa received the customer's money, but the business system incorrectly shows the order as unpaid.

STK Push vs Manual M-Pesa Payment

Without direct integration, a customer might need to:

Open M-Pesa ↓ Choose Lipa na M-Pesa ↓ Choose PayBill / Buy Goods ↓ Enter business details ↓ Enter account/reference ↓ Enter amount ↓ Enter PIN ↓ Complete payment

With an integrated STK Push flow:

Choose M-Pesa on website/app ↓ Confirm phone number ↓ Receive payment prompt ↓ Review request ↓ Enter M-Pesa PIN ↓ Payment processed

The exact user experience depends on the implementation and M-Pesa service being used, but STK Push can reduce the amount of information a customer has to enter manually.

Why Integrate M-Pesa STK Push Into a Website?

There are several potential business benefits.

1. Easier Customer Checkout

Customers don't have to manually transfer payment information between the website and M-Pesa.

This can make the payment process more convenient.

2. Fewer Manual Entry Errors

When customers manually enter PayBill numbers, account references or amounts, mistakes can occur.

With an integrated workflow, the business system can provide relevant transaction information programmatically.

3. Automated Payment Confirmation

The system can process payment results without requiring staff to manually check every transaction.

4. Automated Reconciliation

Payments can be associated with orders, invoices or customer accounts.

Safaricom specifically identifies automated payment processing and reconciliation as benefits of M-Pesa API integration.

5. Better Business Workflows

A successful payment can trigger additional processes automatically.

For example:

M-Pesa payment ↓ Order confirmed ↓ Inventory updated ↓ Invoice/receipt generated ↓ Customer notified ↓ Delivery workflow started

The payment becomes part of a larger digital business process.

Which Businesses Can Benefit From STK Push?

M-Pesa STK Push can be useful wherever a legitimate business needs to connect customer payments to a digital transaction.

Examples include:

E-commerce businesses

Customers can pay for online purchases.

Schools and training institutions

Payments can be connected to student or invoice references where the institution's payment setup supports the workflow.

Clinics and healthcare businesses

Eligible payments can be connected to appointments or invoices.

Hotels and accommodation businesses

Customers can pay deposits or booking charges.

Restaurants

Online orders can be paid before preparation or delivery.

Property businesses

Appropriate booking or service payments can be connected to customer records.

SaaS platforms

Businesses may incorporate M-Pesa into supported subscription or account-payment workflows.

Event platforms

Customers can purchase tickets and have successful payments automatically associated with orders.

Delivery businesses

Payment can be connected to a delivery request.

The appropriate implementation depends on the organization's M-Pesa setup, business model and Safaricom's applicable requirements.

Does STK Push Work Only on Websites?

No.

Safaricom describes Daraja as providing M-Pesa APIs that bridge payment integration with web and mobile apps.

The customer-facing application could therefore be:

Website Mobile application Web application E-commerce platform Customer portal Business management system

The architecture can differ, but these systems can communicate with a secure backend that handles the M-Pesa integration.

Does a Website Store the Customer's M-Pesa PIN?

It should not.

The merchant application should never ask customers to provide their M-Pesa PIN directly to the website.

The customer authorizes the transaction through the M-Pesa interface.

The business receives the transaction outcome needed to process the order, not the customer's secret PIN.

Can the Payment Amount Be Set Automatically?

Yes, an integrated business workflow can determine the amount before initiating the STK Push.

For example:

Product KSh 4,000 Delivery KSh 300 -------------------------------- Total KSh 4,300

The backend can then initiate the payment request for the relevant amount.

This can reduce mistakes associated with customers manually entering payment amounts.

Can STK Push Be Tested Before Going Live?

Yes.

Safaricom's Daraja platform provides sandbox capabilities that allow developers to create and test applications before using production services.

Testing should cover more than successful payments.

Developers should also test scenarios such as:

Successful payment Customer cancellation Timeout Invalid input Duplicate requests Callback processing Failed callback handling Transaction reconciliation

Payment systems need to behave correctly when something goes wrong, not just when everything succeeds.

What Is Needed to Integrate M-Pesa STK Push?

The exact requirements depend on the business and Safaricom's current onboarding requirements, but technically an implementation generally involves several components.

Website / Mobile App ↓ Secure Backend ↓ M-Pesa API Integration ↓ Callback Endpoint ↓ Database ↓ Order / Invoice / Account System

The business will also need the appropriate M-Pesa/Daraja setup and credentials for the services it is authorized to use.

Safaricom's Daraja platform provides the official environment for accessing and testing its M-Pesa APIs.

Is M-Pesa STK Push Secure?

STK Push can provide a secure payment experience when the entire integration is implemented correctly.

However, integrating a payment API does not automatically make the entire application secure.

Developers should consider areas such as:

• Protecting API credentials
• HTTPS
• Server-side validation
• Authentication and authorization
• Secure callback handling
• Transaction verification
• Database security
• Logging and monitoring
• Protection against duplicate processing
• Error handling
• Access control

Payment confirmation should also happen on trusted backend infrastructure.

Why Should Payment Processing Be Handled by the Backend?

Consider this unsafe approach:

Browser says: "Payment successful" → Order marked PAID

A customer-facing browser or application should not be the sole authority determining whether money was actually received.

A stronger architecture is:

Customer ↓ Frontend ↓ Backend ↓ M-Pesa ↓ Verified transaction result ↓ Backend updates database ↓ Frontend receives updated status

This keeps critical payment logic under the control of the business's backend.

How M-Pesa Can Connect With Other Business Systems

STK Push becomes even more valuable when connected to other systems.

For example, an e-commerce platform could connect:

Website ↓ M-Pesa ↓ Order Management ↓ Inventory ↓ Accounting ↓ Customer Notifications

A school system might connect:

Student Portal ↓ M-Pesa ↓ Student Account ↓ Payment Record ↓ Receipt

A booking platform might connect:

Booking ↓ M-Pesa Deposit ↓ Payment Confirmation ↓ Reservation Confirmed

Safaricom describes M-Pesa integration as enabling automated execution and reconciliation between M-Pesa and internal business systems.

This is why M-Pesa integration is not simply about adding a Pay with M-Pesa button.

It can become part of the organization's broader digital workflow.

Frequently Asked Questions About M-Pesa STK Push

What is M-Pesa STK Push?

M-Pesa STK Push is a payment flow where a business system initiates an M-Pesa request that sends a payment prompt to the customer's supported phone. The customer reviews and authorizes the payment using their M-Pesa PIN.

Does the customer need to enter a PayBill number manually?

In a properly integrated STK Push workflow, relevant payment information is provided by the business system, reducing the manual steps required from the customer.

Does my website receive the customer's M-Pesa PIN?

No. The customer authorizes the payment through M-Pesa. Your website should never ask the customer to submit their M-Pesa PIN directly.

Can I integrate M-Pesa into a mobile app?

Yes. Safaricom's Daraja platform provides M-Pesa APIs for integration with web and mobile applications.

Can M-Pesa automatically update an order after payment?

Yes. The application's backend can process a successful transaction result and update the relevant order or account automatically.

Can STK Push payments fail?

Yes. Payments can be cancelled, time out or fail for other reasons. The application needs to handle unsuccessful transactions correctly.

Can I test the integration before accepting real payments?

Yes. Daraja provides sandbox capabilities for development and testing.

Can M-Pesa payments be reconciled automatically?

M-Pesa API integration can support automated reconciliation between M-Pesa transactions and internal business systems.

Final Thoughts

M-Pesa STK Push provides a way to connect one of Kenya's widely used payment methods directly to websites, mobile applications and business systems.

Instead of relying entirely on customers to make a manual payment and businesses to manually confirm it, an integrated system can create a structured workflow:

Customer initiates checkout ↓ Website/app sends request ↓ Backend initiates STK Push ↓ Customer receives M-Pesa prompt ↓ Customer authorizes payment ↓ M-Pesa processes transaction ↓ Backend receives transaction result ↓ Order/account is updated ↓ Business workflow continues

The real value is therefore not just the payment prompt.

It is the automation around the payment.

When properly implemented, M-Pesa integration can connect payments with orders, invoices, customer accounts and other internal business processes, helping reduce manual reconciliation and create a smoother digital customer experience.

Integrate M-Pesa With Your Website or App

At Rift Technologies, we build digital solutions that can connect business applications with payment and external API services.

Our M-Pesa & API Integration services can help businesses design payment workflows for websites, mobile applications, e-commerce platforms and custom business systems based on their requirements.

Whether you need an online checkout, payment confirmation, order reconciliation or integration between M-Pesa and an existing system, the implementation should be designed around both the customer experience and the business process behind it.

Ready to connect M-Pesa to your website or application?

Integrate M-Pesa Into Your System →