- How do I install and configure laravel-daraja for M-Pesa STK Push in Laravel?
- Install it with composer require starnerz/laravel-daraja, then add the DARAJA_MODE, consumer key and secret, STK shortcode, passkey and callback URL values to your .env file. After that, run php artisan daraja:token to confirm the credentials and token endpoint work. No manual service provider registration is needed on supported Laravel versions.
- Which Laravel and PHP versions does laravel-daraja support?
- The current release requires PHP 8.3 or newer and Laravel 12 or 13. Older Laravel majors such as 10 and 11 are not covered by the stated requirements, so check the package tags if you are maintaining a legacy application. The Guzzle constraint is ^7.8 || ^8.0, so both Guzzle 7.8+ and Guzzle 8 resolve.
- Does laravel-daraja support Guzzle 8?
- Yes. Version 5.2.0 widened the constraint from ^7.x to ^7.8 || ^8.0 without changing package code or configuration. Note that the Guzzle 7 path is exercised on Laravel 12 and the Guzzle 8 path on Laravel 13, so the newer HTTP client is validated alongside the newer framework major. Applications still pinned to Guzzle 7.4 through 7.7 now fall below the floor.
- How do I test M-Pesa STK Push callbacks in Laravel without calling Safaricom?
- Callbacks are delivered to your application as events, so you can keep the HTTP layer thin and test your business logic by dispatching the callback event directly. You can also fake the outbound HTTP calls when asserting the STK push request itself was built correctly. This lets you cover the success path and the failed or cancelled result paths in a normal feature test suite.
- How do I handle the STK Push result when the customer pays?
- The push call returns a typed response with helpers such as accepted() and the checkoutRequestId that identifies the attempt. The actual payment result arrives later on your callback URL as an event, where callback->successful(), checkoutRequestId and receipt() give you what you need to mark an order paid. Store the checkout request ID so you can match the callback to the order it belongs to.
- How do I switch laravel-daraja from sandbox to production?
- Set DARAJA_MODE to production and supply your live consumer key, secret, shortcode, passkey and callback URL. Your callback endpoint must be publicly reachable over HTTPS because Safaricom posts the result there rather than returning it in the original request. Because this is a live payments path, validate the switch in staging and confirm your go-live checklist with Safaricom before taking real money.
- Does laravel-daraja cache the M-Pesa OAuth access token?
- Yes, the package caches Daraja access tokens instead of requesting a new one for every API call, which avoids unnecessary auth round trips and rate limiting. The daraja:token Artisan command fetches a token so you can verify credentials at any time. Cache behaviour follows your Laravel cache configuration, so a shared cache store is worth using in multi-server deployments.
- Which Daraja APIs does laravel-daraja cover?
- It wraps all seventeen Safaricom Daraja APIs, including STK Push, C2B, B2C, B2B, Dynamic QR, M-Pesa Ratiba and Bill Manager. Each is exposed through the Daraja facade with typed responses rather than raw arrays. It is not a multi-provider payment abstraction, so your domain model should still reflect Daraja concepts such as shortcodes, passkeys and callbacks.
- Does laravel-daraja work with phone numbers like 0712345678?
- Yes. The STK push example accepts a local Kenyan format such as 0712345678 and the package normalises it to the format Daraja expects. That removes a common source of validation bugs when numbers come from user input or a database field. The documentation covers the accepted formats for each API.
- Is laravel-daraja actively maintained, and what are the risks of using it?
- It is a permissively licensed package from a single maintainer, with a published security contact at [email protected] and documentation that has moved to a dedicated domain, so vendor continuity and security responsiveness are worth assessing for your team. Because M-Pesa failures are customer visible and financially material, stage-test upgrades rather than rolling them straight to production. Alternatives include building your own Guzzle client against Daraja or using a broader payment abstraction if you need multiple providers.