M-Pesa Integration Explained: STK Push vs Paybill

For most Kenyan customers, paying by M-Pesa is the default. If your website, app or system cannot accept M-Pesa smoothly, you lose sales and spend hours reconciling payments by hand. Safaricom’s Daraja API makes integration possible, but the options can be confusing. Here is a plain-language guide to the two most common approaches.

Lipa na M-Pesa Online (STK Push)

With STK Push, your system sends a payment request directly to the customer’s phone. The customer sees a prompt showing your business name and the amount, enters their M-Pesa PIN, and the payment is complete.

Best for: online checkouts, invoice payments and any situation where your system knows the exact amount due.

• The customer never has to type a till or account number, so there are fewer mistakes
• Your system receives a confirmation (a callback) and can update the order immediately
• It works on any phone that has M-Pesa

Paybill and Till payments (C2B)

With customer-to-business (C2B) payments, the customer initiates the payment from their own M-Pesa menu, entering your Paybill number and an account reference. Your system is notified when the payment arrives.

Best for: recurring payments such as rent, school fees and loan repayments, where customers pay on their own schedule.

• Customers can pay anytime, even without visiting your website
• The account reference (for example a house number or member number) lets your system match the payment
• You need a fallback for payments with a wrong or missing reference

Getting reconciliation right

Receiving the money is only half the job. A good integration also:

1. Records every callback exactly once. Callbacks can arrive more than once, so the system must recognise duplicates (this is called idempotency).
2. Matches payments to the right invoice or customer, including partial and over-payments.
3. Queues anything it cannot match for a person to review, instead of silently ignoring it.
4. Handles timeouts. If a customer ignores an STK prompt, the order should not stay “pending” forever.
5. Keeps an audit trail of every transaction for accounting and dispute resolution.

Security essentials

Keep your Daraja credentials out of your code and website files, restrict who can see them, and only accept callbacks over HTTPS on a hard-to-guess URL. Never trust the amount sent from a browser: always confirm the amount from the M-Pesa callback before releasing goods or services.

How we can help

We build M-Pesa integrations into every product where it matters. RentFlow uses both STK Push and Paybill with automatic matching for rent, and mShop uses STK Push at checkout. If you need M-Pesa in your own website or system, our software development team can design an integration that reconciles itself, so your team can stop checking statements line by line.