Weave Code
Daraja Laravel Package
savannabits/daraja
Laravel package for Safaricom's M-Pesa Daraja API, simplifying STK Push, C2B, B2C, transaction status and reversal requests with fluent, configurable methods so you can integrate mobile payments into your PHP app quickly.
Savannabits Daraja
Savannabits Daraja is a Laravel package that wraps Safaricom's M-Pesa Daraja API, giving PHP developers a clean, configurable way to integrate mobile money payments. It handles authentication and common Daraja workflows so you can focus on business logic.
- Supports STK Push, C2B, and B2C payments
- Includes transaction status, account balance, and reversal endpoints
- Publishable configuration with environment-based credentials
- Laravel-friendly facades, exceptions, and callback handling
- Simple Composer installation for Laravel applications
Frequently asked questions about Daraja
- How do I install savannabits/daraja in a Laravel application?
- Install it with Composer using composer require savannabits/daraja, then publish the package config (and any migrations it ships) with the vendor:publish command. Put your consumer key, secret, shortcode and passkey in .env so credentials never live in code. Pin the exact 1.0.0 release rather than a caret constraint, because the package was rewritten from 0.2.0 to 1.0.0 in a single pull request with no migration guide.
- Which Laravel and PHP versions does savannabits/daraja support?
- The declared support is PHP 8.1 and Laravel 9, which dates the package to late 2022. If your target is Laravel 10, 11 or 12, treat compatibility as unverified rather than assumed. Check the guzzlehttp/guzzle constraint against your lockfile, and run the sandbox flow before committing to adoption.
- Does savannabits/daraja support STK Push and other M-Pesa APIs?
- Yes. It wraps STK Push (Lipa na M-Pesa), C2B, B2C, reversals, balance queries and transaction status queries behind fluent Laravel-style method calls instead of raw Daraja payloads. What it does not give you is a payments subsystem: no transaction state machine, no idempotency keys and no reconciliation logic. Those parts of the money path remain yours to build.
- How does the package handle M-Pesa OAuth access tokens?
- It acquires the OAuth token automatically and caches it, so you are not hand-rolling the token request against Safaricom on every call. That is one of the main pieces of code you are actually borrowing from this package. For multi-tenant work, confirm how the token cache key is derived, since a single cached token shared across shortcodes will not work.
- How should I handle M-Pesa callbacks with this package?
- Daraja callbacks carry no signature or authenticity scheme, so the package cannot verify them for you. Treat only CheckoutRequestID as trusted input and read the amount from your own database, never from the callback body. Enforce a unique index on checkout_request_id, use lockForUpdate, absorb terminal states, and return 200 OK to duplicate or out-of-order callbacks.
- Is savannabits/daraja safe to use in production for real payments?
- It is a thin HTTP convenience wrapper, not a payment gateway with safety guarantees. Idempotency, indeterminate-state handling, reconciliation sweeps and ResultCode taxonomy (for example, treating 1037 timeout as indeterminate rather than failed) all land on your team regardless. The safe pattern is to hide it behind your own PaymentGateway interface so Daraja never appears in a controller, job or Livewire component and the package stays swappable in a one-class diff.
- Is savannabits/daraja actively maintained?
- It has a single maintainer, roughly 12 GitHub stars, no dependents and no release since November 2022. That is tolerable only because the fork cost is low, but you should pin the exact version and commit the published config into your repository. Pre-approve a fork budget and name an owner before you depend on it.
- Can I use savannabits/daraja for multiple shortcodes or multi-tenant merchants?
- The package's configuration model assumes credentials from a config file, which maps cleanly to a single shortcode. Per-merchant or per-branch routing likely needs scoped container bindings and per-tenant OAuth cache keys. Verify whether the client is bound as a singleton with fixed config, because that decides how cheaply runtime config overrides can be added later.
- What do the package's methods actually return?
- Expect raw Daraja responses rather than domain objects, since the package is a request-shaping wrapper and does not ship its own DTOs. That means anything you consume directly will be coupled to Safaricom JSON field names. Read src/ end to end, enumerate the public surface, and map results into your own DTOs and ResultCode enum at the boundary.
- How long does it take to integrate and go live with Daraja?
- Engineering effort for a first end-to-end sandbox STK Push (persist a row, send the request, handle the callback, query status) is realistically one to three days, plus about a day to audit the package source. The real critical path is non-engineering: shortcode provisioning, Daraja portal app registration, callback URL registration and Safaricom go-live approval, which is measured in weeks. Start that paperwork in the same week as the spike, not after it.
Weaver
How can I help you explore Laravel packages today?