Integrating the M-Pesa Daraja API in Kenya: Checkout for 2026

The verdict in three sentences

The M-Pesa Daraja API works with an OAuth token (about 1 hour) you refresh server-side and an STK Push that pushes a prompt to the customer's phone. Unlike a pure redirect flow, the callback must be validated within roughly 60 seconds, so a status query fallback is essential on unstable networks. This guide compares the authentication cycle, timeout and pending-payment handling between M-Pesa Daraja in Kenya and Orange Money in Senegal.

Authentication cycle and checkout

The Daraja flow runs in three steps: first you obtain an OAuth token via GET /oauth/v1/generate (Basic Auth with your consumer key/secret), then you call STK Push (/mpesa/stkpush/v1/processrequest) with the amount in KES and an account reference, and finally the customer receives a USSD prompt on their phone to enter their M-Pesa PIN.

The token expires after about an hour: cache it and refresh before expiry rather than on every request.

M-Pesa fees follow a tiered scale per amount bracket; budget accordingly rather than a flat percentage for your 2026 merchant agreement.

Timeout and pending payments

The sensitive point with Daraja: the STK Push callback must arrive within roughly 60 seconds. If it doesn't, query the transaction status API rather than assuming failure. Let's compare with Orange Money in Senegal, whose redirect flow allows a longer window.

In Senegal, Orange Money redirects the client to a payment page where they enter their secret code, with a window of about 3 minutes, so its catch-up logic is more forgiving than Daraja's 60-second STK Push.

Mini case study

Joseph runs an online grocery in Nairobi (Kilimani). With an STK Push checkout and no status fallback, 6% of his 250 monthly orders stayed pending because the callback didn't always arrive on his customers' networks, i.e. 15 murky orders. By adding a status query loop during the 60-second window plus a 15-minute reconciliation cron, the unresolved rate drops to 1%, about 2-3 per month. On an average basket of KES 1,800, he secures roughly 12 x 1,800 = KES 21,600 per month that used to end in dispute or abandonment.

FAQ

Must the Daraja OAuth token be regenerated for each payment? No. It lasts about an hour: cache it server-side and refresh just before expiry. Regenerating on every request slows checkout needlessly.

Why is a status query essential with M-Pesa? Because the STK Push callback may not arrive on an unstable network. Querying the transaction status confirms the outcome and avoids leaving a paid order as "pending".

What's the difference with Orange Money? Orange Money redirects the client to a web page with a roughly 3-minute window, longer than Daraja's ~60-second STK Push, so its catch-up can be less aggressive.

What do I do with a payment still pending after 60 seconds? Query the status API immediately, then let the reconciliation cron poll every 15 minutes. Most resolve themselves within an hour.

How much does an M-Pesa Daraja integration cost? 2026 ballpark: KES 350,000 to 600,000 equivalent depending on your stack, excluding M-Pesa's tiered per-transaction fees.

Let's talk about your project. We integrate M-Pesa, Wave and Orange Money with polling, timeout and pending-payment handling. WhatsApp +221 77 596 93 33.