Payment Gateways in Kenya: How to Set Up M-Pesa, Pesapal and Card Payments

A customer is ready to pay. They tap the button on your website, and what happens next decides whether you have the money today, tomorrow, or never.

On a lot of Kenyan sites, what happens next is a line of text: "Send to Paybill 123456 and WhatsApp us the code." It works, right up to the evening you are matching forty M-Pesa messages against forty orders, and one of them does not match anything.

There are three ways to take money online in Kenya. Most businesses need one or two of them, not all three. This guide shows which is which, how to set each one up, and the mistakes that leave paid orders sitting in your dashboard marked unpaid.

The Three Routes, Compared

The difference that matters most is who sits in the middle. With M-Pesa direct, the money goes from the customer's M-Pesa to your Paybill or Till, and Safaricom is the only party taking a fee. With a gateway, the gateway takes the payment and passes it on to you, and it charges for doing so. You are paying for convenience: one integration, one dashboard, and cards included.

Which One You Need

• You sell locally and most customers are on Safaricom. M-Pesa direct. This is most Kenyan shops, schools, clinics and service businesses.
• You sell to Kenyans abroad or to visitors. Add a card gateway. Someone paying from London or Dubai may not have M-Pesa on their phone.
• Your buyers are companies. Add cards. A procurement officer paying on a company card cannot use their personal M-Pesa.
• You want a single dashboard for everything and you accept a gateway rate on your M-Pesa payments too. Pesapal on its own can cover both.
• You need Airtel Money, bank transfer or PayPal as well. Ask. We integrate those too, and the right mix depends on who your customers are.

Before You Start

• A Paybill or Till Number, for M-Pesa direct. Or a Daraja API merchant account from Safaricom. If you do not have one, it can be registered for you.
• A website on HTTPS. Both Safaricom and the gateways send the payment result back to an address on your site, and that address has to be reachable, securely, from the internet.
• A real checkout. WooCommerce, another shop platform, or a custom-built system that creates an order before payment.
• A merchant account with the gateway, if you are adding Pesapal or cards. Expect business verification before you can take live payments.
• A real phone and a real card for testing with real money before you launch.

Setting Up M-Pesa Direct

This is the route we recommend as the base of almost every Kenyan checkout. The customer taps Pay, a prompt appears on their phone, they enter their PIN, and your site marks the order paid on its own. No SMS forwarding, no reconciliation.

1. Get your Paybill or Till

The money needs somewhere to land. If you already take M-Pesa in a shop, you probably have one. Use the number that should receive website payments.

2. Create a Daraja account and an app

Daraja is Safaricom's API for developers, at developer.safaricom.co.ke. You create an account, then an app, which gives you the consumer key and secret your website uses to talk to M-Pesa.

3. Build it in the sandbox

The sandbox is Safaricom's test environment. Your site sends an STK Push request, a test prompt goes out, and Safaricom calls your callback URL with the result: paid, cancelled, wrong PIN, or timed out. Your site has to handle every one of those, not only the happy path.

4. Request go-live

Once it works in the sandbox, you apply to move to production, which links your real Paybill or Till to the app and issues live credentials.

5. Test with real money

Run real KES 1 transactions through your live Paybill before you tell a single customer. The sandbox does not behave exactly like live, and the only way to know money flows correctly is to watch it flow.

6. Let the callback do the reconciliation

Every successful payment triggers your own logic: mark the order paid, send the receipt, alert the team. That is the step that ends the evening of matching codes by hand.

For the technical detail, with a working code example, read how to add M-Pesa payments to your website. On WooCommerce specifically, the WooCommerce M-Pesa guide covers STK Push, Paybill and Till end to end.

Setting Up Pesapal

Pesapal is a Kenyan payment gateway. Your site sends the customer to Pesapal's payment page, the customer chooses M-Pesa or a card there, and Pesapal tells your site the result. Its current API is version 3.0, documented at developer.pesapal.com.

Pesapal also publishes official plugins for e-commerce platforms, listed on its developer site. A plugin saves building the API calls yourself. It does not save you the testing.

Adding Card Payments

Do not build card processing yourself. Let the gateway collect the card details on its own secure payment page. The card number never touches your server, which keeps most of the security burden with the gateway, where it belongs.

In practice that means one of three things:

• Pesapal, if you want M-Pesa and cards through one gateway.
• Flutterwave alongside M-Pesa direct, if you want cards from a separate provider.
• PayPal, for customers abroad who would rather not type a card number at all.

At checkout the customer sees two or three clear options, M-Pesa first, and picks the one they have. Put M-Pesa first because that is what most Kenyan customers will use. A checkout that opens on a card form tells a local customer the shop was not built for them.

The Mistakes That Leave Orders Unpaid

Almost every broken payment we are asked to fix is one of these.

Marking the order paid on the redirect

The customer lands back on your "thank you" page, so the site marks the order paid. But a page load proves nothing. People close the tab, the phone loses signal, somebody types the URL. The only trustworthy signal is the callback from Safaricom or the gateway, confirmed against the provider's own record.

A callback the provider cannot reach

The payment succeeds and M-Pesa shows the money, but the order stays unpaid. Usually a security plugin, a firewall rule or a maintenance mode is blocking the provider's request to your callback URL, or the URL is plain HTTP. Test it from outside your own network.

Caching the checkout

Speed plugins that cache every page will cache the checkout and callback pages too. Exclude them. A cached callback answers every payment with the same stale response.

Testing only in the sandbox

The sandbox passes, launch day fails. Always run real transactions on the live account before customers do.

No plan for the customer who ignores the prompt

People miss the STK prompt, enter the wrong PIN, or are on a call when it arrives. Show a clear "did not get the prompt? Try again" button, and offer Paybill as a fallback, instead of leaving them staring at a spinner.

What It Costs

The KES 1,000 a year covers STK Push, Paybill and Till confirmations, B2C payouts, reconciliation and reporting, Daraja registration with Safaricom, live test transactions, and ongoing support for the year. It is a flat fee, not a cut of every transaction. Most integrations go live within 5 to 10 working days, and more complex setups take 2 to 4 weeks.

Adding Pesapal or a card gateway to an existing site is quoted for the job, because it depends on the platform you run. If you are building a new shop, see what an e-commerce website costs in Kenya.

Frequently Asked Questions

What is the best payment gateway in Kenya?

It depends on who pays you. If nearly all your customers are in Kenya, M-Pesa direct through Safaricom's Daraja API is the core of the checkout. If you also sell to people abroad or to companies paying by card, add a card gateway such as Pesapal or Flutterwave. Many stores run M-Pesa direct and a card gateway side by side.

Can I accept M-Pesa and card payments on the same checkout?

Yes. Either run M-Pesa direct and a card gateway as two payment options at one checkout, or use one gateway such as Pesapal that takes both M-Pesa and cards on its own payment page.

Do I need a Paybill or Till number to accept M-Pesa on my website?

For M-Pesa direct, yes. You need a Paybill, a Till Number, or a Daraja API merchant account from Safaricom. We can register the Daraja account on your behalf or work with what you already have.

How long does M-Pesa integration take?

Most of our integrations go live within 5 to 10 working days. More complex setups with custom reconciliation, B2C payouts or multi-account routing take 2 to 4 weeks.

How much does Pesapal charge per transaction?

Pesapal does not publish its merchant rates on its homepage, so ask Pesapal for current pricing when you open a merchant account. Compare that against Safaricom's own tariff on your Paybill or Till before deciding which payments go through which route.

Is it safe to take card payments on my website?

Yes, when the gateway collects the card details on its own secure payment page. The card number never touches your server, which keeps most of the security burden with the gateway rather than with you.

What does M-Pesa integration cost with WPfoss?

KES 1,000 per year, all-inclusive. That covers STK Push, Paybill and Till confirmations, B2C payouts, reconciliation, Daraja registration, live test transactions and ongoing support. It is a flat annual fee, not a cut of every transaction.