- How do I install itsmurumba/laravel-mpesa in a Laravel application?
- Install it with Composer using composer require itsmurumba/laravel-mpesa. Laravel package auto-discovery registers the service provider and facade, so no manual provider entry is usually needed. Publish the config file with php artisan vendor:publish and add your Daraja consumer key, secret, shortcode, passkey, and callback URLs.
- Which Laravel and PHP versions does laravel-mpesa support?
- The package advertises support for Laravel 5 through Laravel 12, making it unusually broad for a Daraja wrapper. Exact PHP constraints are defined in its composer.json, so check that file before installing on older or newer runtimes. Because seven Laravel majors is a wide claim, confirm the repository has a real CI matrix for the versions you depend on.
- Does this package cover STK Push, C2B, B2C, and transaction status?
- Yes, the package is described as covering STK Push, C2B, B2C, transaction status, and additional Daraja calls. Before committing, confirm the exact methods for the endpoints you need, especially C2B validation and confirmation, reversal, and account balance. If an endpoint is missing, you can call Daraja directly or extend the package behind your own gateway interface.
- How do I configure M-Pesa Daraja credentials and callback URLs?
- After publishing the package config, set your consumer key, consumer secret, shortcode, passkey, environment, and callback URLs there. The config-driven setup is intended to keep Safaricom-specific values out of your application code. For multi-tenant apps, avoid scattering shortcodes and passkeys across call sites and instead resolve them in your own configuration layer.
- Do I need a public HTTPS callback URL to test STK Push locally?
- Yes. Daraja callbacks must reach a publicly available HTTPS endpoint, so localhost URLs will not work for the full STK Push flow. Use a tunneling tool such as ngrok or Expose to forward requests to your local Laravel app during development. Sandbox credentials come from the Safaricom developer portal and are provisioned per app.
- Does laravel-mpesa handle callback verification and idempotency?
- Do not assume it does. Payment wrappers commonly leave source IP allowlisting, payload validation, replay protection, and duplicate-callback handling to the integrator. Treat callback security and idempotency as your responsibility, and key idempotent processing on CheckoutRequestID or MerchantRequestID unless you verify the package exposes its own mechanism.
- How does laravel-mpesa surface Daraja API errors?
- The package advertises helpful error handling, but you should verify the implementation in source rather than relying on the README. Check whether Daraja failures become typed exceptions, structured response objects, or raw arrays, and whether any errors are swallowed. For money movement, map errors into your own domain exceptions so billing and order code is not coupled to Safaricom response shapes.
- Can I use different M-Pesa shortcodes or credentials per tenant at runtime?
- The package is config-driven and is likely oriented around a single global Daraja configuration. Runtime or per-tenant overrides are not clearly guaranteed, so test this before designing a multi-tenant flow around it. A safe approach is to resolve tenant credentials in your own service and configure the package per request or wrap it behind a tenant-aware gateway adapter.
- Is itsmurumba/laravel-mpesa production-ready and actively maintained?
- It is MIT licensed and usable, but the social signals are weak: roughly 20 stars, effectively one maintainer, no vendor SLA, and limited peer review of money-moving code. Check the last 12 months of commits and issue triage, and verify the Laravel 5–12 support claim against CI. In production, place it behind an internal MpesaGateway interface so you can patch or fork it without affecting your domain code.
- What should I use instead of laravel-mpesa for M-Pesa in Laravel?
- Alternatives include other Laravel Daraja wrappers, Safaricom's direct Daraja HTTP API, or a small custom Guzzle client behind your own gateway contract. Compare endpoint coverage, CI and test coverage, error handling, callback security, and maintenance cadence rather than star count alone. If you need multi-tenant credentials or strict idempotency, a thin in-house adapter is often easier to control.