- How do I install iankumu/mpesa in a Laravel application?
- Install it with composer require iankumu/mpesa, then publish the package's config file, and the migrations if you intend to persist transaction records, using the artisan vendor:publish command. The service provider is auto-discovered, so no manual registration is needed in a standard Laravel app. After publishing, add your Daraja sandbox or production credentials and confirm the callback routes are reachable.
- Which M-Pesa Daraja APIs does this package support?
- It wraps the Safaricom Daraja endpoints for STK Push (Lipa na M-Pesa), C2B, B2C, transaction status queries, and reversals, along with callback handling. That covers the common checkout, collection, disbursement, and follow-up query flows. If you need a Safaricom product outside that set, confirm coverage in the repository before committing to the package.
- Does iankumu/mpesa support Laravel 13 and which PHP versions work?
- Version 2.3.0 is a compatibility release that confirms Laravel 13 support. Because support is confirmed per release rather than under an announced long-term support policy, check the composer.json constraints before upgrading a major Laravel version. Pin the package version in composer.json and run your test suite against upgrades in CI.
- How do I configure M-Pesa credentials such as the consumer key, secret, passkey, and shortcode?
- The package reads credentials from its publishable config file and acquires the OAuth token from them automatically. For anything beyond sandbox, inject the consumer key, consumer secret, passkey, and shortcode through environment variables or a secrets manager with per-environment separation. Avoid committing real credentials into a config file published into your repository, which is the easy path but the wrong default.
- How should I handle M-Pesa callbacks with this package?
- M-Pesa callbacks are asynchronous and Safaricom retries deliveries, so expose a publicly reachable HTTPS route and exclude it from CSRF protection. The package provides the transport and callback plumbing, but you should persist the raw payload, dispatch a queued job, and apply an idempotent state transition instead of processing inside the controller. Add a reconciliation job for payments whose callbacks never arrive.
- Does the package validate and authenticate inbound M-Pesa callbacks for me?
- Treat callback validation as your own responsibility until you have confirmed otherwise by reading the source. In practice that means verifying the payload against your own records, never trusting amounts or identifiers from the callback alone, and reconciling with the transaction status query API. The package gives you the transport, not the ledger or the business-level verification.
- Can I use iankumu/mpesa outside Laravel or from a non-PHP service?
- No. It is a Laravel wrapper rather than a standalone SDK, so it cannot be consumed outside PHP and Laravel. In a polyglot or multi-tenant architecture where a non-Laravel service also initiates payments, use a standalone M-Pesa SDK or an internal payments service instead. Keep this package at the edge of the domain, behind your own payment abstraction.
- How do I test STK Push and B2C safely in the Safaricom sandbox?
- Point the config at Safaricom's sandbox environment and use the sandbox shortcode and test credentials to exercise STK Push and B2C without moving real money. Callbacks need a public HTTPS endpoint, so use a tunnel such as ngrok or a staging URL during local development. Write feature tests around your own callback handler, including replaying the same payload twice to prove idempotency.
- Is iankumu/mpesa safe to use for production payments?
- Installation is straightforward, but the dominant risks are vendor and domain risks rather than code risks. The package has a small maintainer base, a thin release history, and no visible long-term support, security disclosure, or deprecation policy, while Safaricom controls the upstream API contract. Duplicate STK prompts, timeouts treated as failures, and un-reconciled callbacks are the failure modes that reach customers and finance, and the package does not solve them for you.
- What happens if iankumu/mpesa is abandoned, and what are the alternatives?
- Because it is a thin wrapper around Daraja HTTP calls, the cost of reimplementation is roughly proportional to how many call sites and Safaricom products you use. Keep it behind your own payment interface so that swapping in another wrapper or a direct Daraja client stays a contained change. Pin versions, monitor maintainer responsiveness, and track issue response times before this becomes a revenue-critical path.