M-PESA for online businesses in Kenya 2026: paybill, Daraja, STK Push

Online is the sector where paybill beats till by design. A cart needs a reference so the system knows which order the payment belongs to. Till has no reference field. Paybill has the account number, which is the canonical carrier of the order ID in every Kenyan ecommerce integration. Whether you run a Shopify store, WooCommerce, a custom Next.js checkout, or a Jumia storefront, the pattern is the same underneath.

What an online business needs from M-PESA

• Per-order references. Every payment must map to exactly one cart. The paybill account number is that reference.
• Programmatic checkout. Nobody wants to type an 8-digit paybill and a 12-character order code on a phone at 11pm. STK Push handles that.
• Instant confirmation. Your backend must know within seconds that the money landed, so it can release digital goods or trigger fulfilment.
• Failure handling. STK Push can fail (timeout, wrong PIN, insufficient balance, cancelled). You need clean UX for retry and abandonment.
• Reconciliation at scale. Not per-shift, per-webhook. Every callback is a durable record with the Safaricom transaction ID.

Recommended setup: paybill + Daraja or aggregator

• Paybill + Daraja direct integration. Lowest per-transaction cost, most control, needs an engineer who understands OAuth, HMAC, and idempotent webhooks. Right for merchants doing more than KES 5M a month, or where every basis point matters.
• Paybill + aggregator (Pesapal, Flutterwave, DPO, iPay, Cellulant, Kopo Kopo). Live in days, not weeks. One integration covers M-PESA + Airtel Money + cards. Aggregator takes 1.5 to 3.5 percent per transaction on top of the Safaricom fee. Right for early-stage stores.
• Buy Goods till. Only if your order value is a fixed number (subscription, single-price digital product) and the customer enters no cart-specific reference. Rare in ecommerce.
• Pochi la Biashara. Only for micro-hustles selling through Instagram DM or WhatsApp status, where the "checkout" is a conversation. See Pochi complete guide.

Charges you will actually pay

On paybill, both sides pay. The customer pays the send fee (tiered, KES 10 to KES 108). The merchant pays the Lipa na M-PESA fee (tiered, capped at KES 108). If you use an aggregator, add their percentage on top. Full band-by-band schedule in M-PESA charges 2026.

The customer-side fee is why some checkouts move to Buy Goods with the order ID encoded in the amount (e.g. KES 2,412 for order 12), though this only works up to the point of order-ID collision. For most real stores, paybill wins on match reliability even though the customer pays a fee.

Setup steps

Full walkthrough in how to get an M-PESA paybill (2026). For online-specific setup:

1. Apply for a paybill via m-pesaforbusiness.co.ke or a Safaricom Shop. Tell them you need STK Push (Lipa na M-PESA Online).
2. Register on Safaricom Daraja portal (developer.safaricom.co.ke), create an app, get consumer key and secret.
3. Go through the Daraja sandbox: OAuth token, STK Push simulation, callback handling. Budget 1 to 2 engineer-days.
4. Register your production callback URLs (validation URL + confirmation URL). Safaricom activates production access after review, usually within a week.
5. Integrate the STK Push endpoint into your checkout page. Handle timeouts (60 seconds), user cancels, and network failures gracefully.
6. Set up a webhook processor to update order status on confirmation.

Reconciliation notes specific to online

The clean pattern:

• On checkout, generate a durable order ID (never the primary-key auto-increment, always a random hash or UUID).
• Pass the order ID as the STK Push AccountReference.
• The confirmation callback fires with MpesaReceiptNumber, Amount, and your account reference.
• Idempotent upsert in your database: transaction ID as the primary key, order ID as the foreign key.
• Double-book the callback into a separate mpesa_receipts table so you have an audit trail independent of the orders table.
• Nightly reconciliation: pull the paybill statement (Safaricom Business app or Daraja Statement API), diff against your mpesa_receipts table, alert on any mismatch.

Common problems and how to fix them

• STK Push timed out. The customer did not enter the PIN in 60 seconds. Prompt them to retry from the checkout. Do not double-charge.
• Callback never arrived. Safaricom retries, but occasionally webhooks are lost. Poll the Daraja Query API for the transaction status if the customer says they paid.
• Duplicate paybill payment. Customer paid twice by refreshing checkout. Refund the duplicate immediately from the Business app or via Daraja B2C.
• Wrong account reference. Customer paid via manual paybill entry (not STK Push) and typed the order ID wrong. Your callback fires but you cannot match. Have a fallback queue for "unmatched receipts" that a human can resolve.
• Aggregator webhook signature mismatch. Rotate secrets, re-verify the HMAC. Never process a callback whose signature does not check out.

KRA and eTIMS for ecommerce

KRA treats an online sale exactly like an offline sale. The rules:

• eTIMS invoice on every VAT-registered sale. Integrate via the eTIMS API from your order-confirmation webhook. Email or in-app deliver to the customer.
• VAT is 16 percent. Digital services sold to Kenyan customers by a non-resident supplier also fall under DST/VAT-on-digital-services rules.
• Cross-border sales. Selling to a Ugandan or Tanzanian customer via M-PESA is possible via IMT rails; VAT treatment depends on the goods and delivery jurisdiction.
• Digital Service Tax was replaced by a broader Significant Economic Presence Tax in FY25. If you are a Kenyan business selling digital goods, the standard VAT + income-tax rules apply.

Worked example: a KES 3M-a-month online store

A niche Kenyan ecommerce store (skincare, say) doing KES 3 million monthly gross, running paybill + STK Push through a direct Daraja integration. Ticket mix:

1.76 percent of GMV paid to Safaricom on merchant fees. If you routed through an aggregator at 2 percent, add another KES 60,000, taking your all-in to KES 112,910 (about 3.76 percent of GMV). Direct Daraja is materially cheaper at scale, and the break-even against most aggregators is around KES 3 to KES 5 million monthly turnover.

See also: M-PESA for retail shops · M-PESA for restaurants and cafes · Business hub.