How Much Does M-Pesa Integration Cost in Kenya?

The integration types

Each of these is a distinct piece of work with its own callbacks and failure modes. Many projects need two or three.

• STK Push (Lipa na M-Pesa Online): your system triggers a payment prompt on the customer's phone.
• C2B: customers pay to your paybill or till and your system is notified to match the payment.
• B2C: your system pays customers, staff or agents, for example refunds, loans or commissions.
• Transaction status, balance and reversal queries for operations and reconciliation.

What drives the cost

A simple checkout on a website that needs only STK Push, with one paybill and a clear order reference, is at the small end. Cost climbs with the number of integration types, with reconciliation against your own records, with payouts (which need approval controls), and with the number of systems that must be updated when a payment arrives.

Remember that Safaricom's own transaction charges are separate from what a developer charges to build the integration. The build is a one-off cost plus maintenance; the tariffs are paid per transaction for the life of the system.

• Number of integration types (STK Push, C2B, B2C, queries).
• Reconciliation: matching payments to invoices, orders or member accounts, including wrong references.
• Payout controls: approval workflows and limits for B2C.
• Other systems to update: ERP, accounting, SMS receipts, customer notifications.
• Go-live support: preparing for Safaricom's production approval process.

Callbacks, failures and reconciliation

The part that separates a working integration from a fragile one is how it handles failure. Customers cancel prompts, phones are off, callbacks arrive late or twice, and paybill payments arrive with a mistyped account number. Each of those must end in a known state that staff can see, not a payment that exists in M-Pesa and nowhere in your system.

Budget for a proper reconciliation screen and a daily automated match against the M-Pesa statement. It is less visible than the checkout button and far more valuable.

Security for payment endpoints

Your callback URL is a public endpoint that tells your system money has arrived. If it trusts whatever it receives, an attacker can post a fake confirmation and receive goods for free. Validate callbacks, confirm transactions with Safaricom before fulfilling high-value orders, keep API credentials out of source code and front-end bundles, and restrict who can trigger B2C payouts.

For systems that pay out money, a penetration test of the payment flows before launch is money well spent.

How to scope it well

Write down every way money moves in and out, who is paying whom, what reference they use, which system must know, and what staff need to see when something goes wrong. A developer can then quote accurately, and you can compare quotes that describe the same work rather than one that includes reconciliation and one that quietly does not.

Key takeaways

• The Daraja connection is the easy part; reconciliation and failure handling drive the cost.
• STK Push, C2B, B2C and queries are separate pieces of work, and many projects need several.
• Safaricom transaction tariffs are separate from the one-off build and maintenance cost.
• Validate callbacks and protect credentials, or fake confirmations will cost you.
• Scope every money flow and reference before asking for quotes, so they are comparable.

Frequently asked questions