How to Go Live on Safaricom Daraja (2026): The Exact Steps

Your M-Pesa integration works in the sandbox. Going live is the step that gives you production keys for your own Paybill or Till, so real customers can pay. SiteBoma took its own Paybill, 1393006, live on Safaricom Daraja on 29 October 2026. This guide follows exactly what the portal asked for, in order, plus the details that decide whether your first real payment works.

What you need before you start

• An active Paybill or Till (Buy Goods) number registered to your business. Ours was one day old and Daraja accepted it.
• The M-Pesa Organisation Portal username (org.ke.m-pesa.com) of your Business Administrator or a Business Manager. It is a username, not an email address. For a Till, the primary Till operator ID works too.
• That person's phone. Safaricom sends a one-time code to it during go-live, so they need to be free for a couple of minutes.
• Your organisation name exactly as M-Pesa has it. You can read it in the Organisation Portal under My Organization.
• A Daraja account at developer.safaricom.co.ke.
• Your integration tested in the sandbox against the test short code 174379, with an HTTPS callback URL on your own domain.

Step 1: Open Go Live

Sign in to the Daraja portal and choose Go Live in the left menu. The form is headed "Enter Organizational Information" and has two stages: your organisation's details, then a one-time code.

Step 2: Enter your organisation's details

Tick the box that accepts Safaricom's terms and conditions, then press Next.

Step 3: Enter the code from Safaricom

Safaricom texts a six-digit code to the phone behind that username. The form shows the number partly hidden, for example 2547*******9, so you know which phone to check. If nothing arrives, use Resend Code.

Step 4: Choose the products

On the same screen Daraja lists the APIs it can switch on for your short code. For a website that takes payments, two are enough:

• Lipa Na Mpesa Production: STK Push, the prompt on the customer's phone, and STK Push Query, which tells you whether that prompt was paid.
• C2B v2: payments a customer makes from the M-Pesa menu to your Paybill or Till, confirmed to your server.

The others do other jobs. Transaction Status, Account Balance and Reversal need an API operator and an encrypted security credential, set up in the Organisation Portal first. M-Pesa Ratiba, for standing orders, is switched on only after a commercial agreement with Safaricom. When your choice is made, press Submit.

Step 5: Collect your production keys

Our production app appeared at once under My Apps, Production Apps, named Prod- followed by the organisation name and a number. Its card shows:

• the Consumer Key and Consumer Secret, each with a copy button
• the Passkey for STK Push
• your short code and the products you chose

Two emails arrived within seconds: "Congratulations for going live!" with the production URLs, and "STK PUSH CREDENTIALS" from [email protected] with your short code and passkey. Treat all three keys like a bank password. Keep them on your server, encrypted if you can, and never in a code repository, in a page the browser loads or in a chat message.

Step 6: Point your code at production

The STK Push password is your short code, your passkey and a timestamp joined together, then Base64 encoded. The timestamp is the current time in Kenya written as YYYYMMDDHHMMSS, and the same timestamp goes in the request. For a Paybill the TransactionType is CustomerPayBillOnline; for a Till it is CustomerBuyGoodsOnline.

Step 7: Register your Paybill URLs

For payments made from the M-Pesa menu, Safaricom needs to know where to send the confirmation. Call the register URL API once with:

• ShortCode: your Paybill or Till number
• ResponseType: Completed, so a payment still goes through if your validation URL does not answer
• ConfirmationURL and ValidationURL: public HTTPS addresses on your own domain

Two rules catch many people out. First, Daraja refuses URLs that contain words such as M-Pesa, Safaricom, exe, exec, cmd, SQL or query, in any mix of capitals, so a path like /mpesa/callback fails. Use neutral names. Second, in production you register these URLs once through the API; to change them later you use URL Management under Self Service in the Daraja portal. Safaricom only calls the validation URL if external validation has been switched on for your short code.

Step 8: Test with real money

Send an STK Push for KSh 1 to your own phone and approve it. Our first one was paid, and the callback reached our server 12 seconds after the PIN, from 196.201.214.200 inside Safaricom's own network. Then pay a small amount to the Paybill from the M-Pesa menu, with an account number your system recognises, and check that the confirmation arrives.

Details that decide whether payments work

• Whole shillings only. The STK amount must be a whole number. Round an invoice with cents up, not down.
• Short references. AccountReference takes at most 12 characters and TransactionDesc at most 13, so a long invoice number gets cut.
• Phone format. Send 2547XXXXXXXX or 2541XXXXXXXX. A number typed as 0712 345 678 or +254 0712 has to be cleaned first.
• Never mark an order paid from the callback alone. The callback is not signed. Ask STK Push Query about that CheckoutRequestID before you deliver anything, and give your callback URL a secret that only Safaricom knows.
• Read the result code. 0 means paid. 1032 means the customer cancelled, 1037 means the phone did not respond in time, 2001 means a wrong PIN and 1 means not enough money.
• "The transaction is being processed" from STK Push Query means the customer has not finished. Ask again a few seconds later.
• Plan for a lost callback. Check pending payments again every minute or so, and a callback that never arrives costs a minute instead of an order.
• Let Safaricom through. If your site sits behind a firewall or Cloudflare, make sure POST requests from Safaricom reach your callback URLs.

Daraja go-live questions

How long does Daraja go-live take?

For SiteBoma it took under a minute after the code from Safaricom was entered, and the production keys and both emails came straight away. Allow time before that for sandbox testing, and after it for a real-money test.

Does Safaricom charge for Daraja?

Going live cost us nothing. The normal M-Pesa charges for your Paybill or Till apply to each payment, the same as without Daraja.

Paybill or Till?

Both work with STK Push. A Paybill adds an account number to each payment, which helps you match payments to invoices or customers. For most online shops a Till (Buy Goods) is enough.

Can someone else take us live?

Yes, apart from one step: the code goes to your Business Administrator's phone, so that person approves it. Everything else can be done for you.

Want it done for you?

If your integration is built and going live is one job too many, SiteBoma does it with you for a one-time KSh 5,000: the Go Live form, the right products, your production keys on your server, Paybill URLs that Safaricom accepts and a live KSh 1 test to your phone. You only approve the code Safaricom sends. Order the Daraja Go-Live package, or ask us a question first.

No integration yet? See our M-Pesa integration packages, or read how the pieces fit together in our guide to M-Pesa integration in Kenya.