- How do I install gathuku/laravelmpesa in a Laravel app?
- Install it via Composer with composer require gathuku/laravelmpesa. Because the package is MIT licensed, an initial sandbox spike is feasible, but pin a commit or fork it for stability. Follow the repository README for service provider and config publishing steps, and verify Laravel compatibility before committing.
- Which Laravel and PHP versions does gathuku/laravelmpesa support?
- The available context does not list exact version constraints, and the last release was in 2021, so do not assume Laravel 9 to 11 or PHP 8.1 to 8.3 support. Check the package composer.json against your application's PHP and Laravel versions before committing. If constraints conflict, vendor and patch the code or choose a maintained alternative.
- Which M-Pesa APIs does this Laravel package support?
- The package advertises wrappers for STK Push, C2B, B2C, transaction status checks, and callback handling. Treat that as the intended product coverage and confirm the exact Daraja API versions in the source before relying on them. Keep each flow behind an internal PaymentGateway interface so you can swap implementations later.
- How do I configure M-Pesa credentials for gathuku/laravelmpesa?
- The package is described as configurable for credentials and Laravel-friendly workflows, so publish its config and store secrets in environment variables or your secret manager. Do not commit M-Pesa consumer keys, passkeys, or initiator credentials to source control. Also verify config-cache behavior after changes, because stale cached config is a known operational risk.
- Is gathuku/laravelmpesa safe to use in production?
- The technical evaluation rates it high risk for production due to a last release in 2021, low adoption, zero dependents, and no observable test coverage. It can be a prototype-grade accelerator, but production use requires a fork or vendor review plus callback validation, idempotency, retries, reconciliation, and monitoring. Do not let billing or domain models depend directly on package classes.
- How should I handle M-Pesa callbacks with this package?
- The package offers callback handling, but the evaluation flags weak callback security as a likely risk, so validate authenticity and payload shape in app-controlled controllers. Persist transactions in tables you own and process callbacks through queued jobs for retries and dead-letter handling. Add idempotency keys because duplicate or malformed callbacks are expected failure modes.
- Does gathuku/laravelmpesa support idempotency, retries, and timeouts?
- The context does not confirm built-in idempotency, retry, or timeout handling, and the evaluation specifically lists these as areas to verify. Wrap package calls with your own timeouts, backoff, rate limiting, and idempotency keys. Use queues and dead-letter queues for asynchronous flows and add a scheduled reconciliation job.
- Can I test gathuku/laravelmpesa against the Daraja sandbox?
- A time-boxed Daraja sandbox spike on a branch is the recommended starting point. The package itself may lack observable test coverage, so add contract tests against the Daraja sandbox for STK Push, C2B, B2C, and callbacks. Pin a commit and document credentials, callback URLs, and failure-mode tests before staging.
- What are alternatives if gathuku/laravelmpesa is unmaintained?
- If upstream stays inactive, fork it into your organization, pin a commit, patch dependency constraints, and assign a maintainer. If the fork becomes costly, replace it with a maintained M-Pesa SDK or a thin Guzzle client while preserving your internal gateway interface. The MIT license makes vendoring feasible, but you own security patches and Laravel upgrade work.
- Does the package cache M-Pesa access tokens and handle API changes?
- The context does not confirm access-token caching or Daraja API version tracking, and M-Pesa Daraja API drift is listed as a risk. Review the source for token caching, expiry handling, and HTTP client behavior before production. Budget for periodic compatibility work and monitor Safaricom documentation for API changes.