Build your M-Pesa integration around clear contracts and payment states.
NetPay is designed for server-side integrations from POS systems, commerce platforms, and business applications. Start with the API overview and use its current request and response contract.
Authenticate server-to-server
Use your integration's client credentials to obtain an access token. Keep secrets on your server; never embed them in browser or mobile application code.
Create an STK Push request
Send the merchant integration ID, amount, phone number, client reference, and other fields required by the current API contract. Use an idempotency key for mutating requests.
Handle the payment outcome
Wait for provider evidence. Make your own order workflow resilient to duplicate callbacks, delays, and non-success outcomes.
Accepted request ≠ completed payment.
A successful STK initiation response means the prompt request was accepted. It does not establish that the customer paid. Update your order only from a final status backed by provider evidence and design for delayed or repeated event delivery.
Integration checklist
- • Keep consumer secrets and passkeys server-side.
- • Use a stable client reference and idempotency key.
- • Verify payment state from provider-backed results.
- • Handle callbacks as untrusted, repeatable input.
- • Confirm C2B and Transaction Status permissions before relying on them.
Need the current API shape?
The API overview documents the current M2M authentication flow, STK Push request, callback behavior, and known limits. Use it instead of copying conceptual marketing examples.
Open API overview