In Safaricom Daraja sandbox runs between September 18 and 23, 2026, I found eight behaviors worth accounting for when building around M-Pesa STK Push. They point to practical safeguards: treat request bodies as sensitive, add your own idempotency, preserve an unknown transaction state, and reconcile failed callbacks rather than waiting for a retry.
These observations are limited to shortcode 174379, test MSISDN 254708374149, and amount 1. The sandbox payer never answered the prompt, so I did not observe a successful payment. This is not a production finding, and the behavior has not been rechecked against Daraja 3.0.
As an Amazon Associate I earn from qualifying purchases.
What these STK Push observations cover
Safaricom describes M-Pesa Express (Prompt) as an API businesses can use to initiate a Buy Goods or Pay Bill payment from a customer account, and Daraja 3.0 as its platform for accessing Safaricom and M-PESA APIs. See Safaricom Daraja developer portal (accessed October 4, 2026). The eight items below describe one author’s sandbox observations, not an API guarantee or population-level measurement.
Eight behaviors I observed
1. The STK Push password contains recoverable credential material
The request password is formed as base64(BusinessShortCode + Passkey + Timestamp). Base64 encodes data; it does not hash or conceal it. A captured request body can therefore expose the passkey. Treat request bodies as secret-bearing: avoid logging them, and redact them anywhere diagnostic capture is necessary. This observation does not establish Safaricom’s current credential rotation or revocation procedures.
#1 Best Overall
- Use the, easy-to-use, and customizable POS to get started.
- Accept contactless payments, chip cards, Apple Pay, and Google Pay from anywhere, with improved connectivity, extended battery life, and enhanced security. Pay one low rate for every tap or dip.
- No long-term commitments or contracts, no monthly fees- and with offline payments, keep taking payments for up to 24 hours.
- Safely and securely accepts payments anywhere. Plus, get data security, 24/7 fraud prevention, and payment-dispute management at no extra cost.
- Use the, easy-to-use, and customizable POS to get started.
2. Query error 500.001.1001 did not reliably mean “not found”
For a reference known to exist, four of nineteen queries returned HTTP 500 with error 500.001.1001; other queries seconds apart returned HTTP 200. The same error also appeared for an unknown reference. In this sandbox run, that response could not distinguish an absent transaction from a query failure. Preserve an unknown state and query again rather than recording a definitive “not found.” This is an observation, not a confirmed universal Safaricom error contract.
3. Reusing AccountReference did not deduplicate submissions
Two submissions with the same AccountReference were both accepted and received different CheckoutRequestID and MerchantRequestID values. For this test, the reference was not an idempotency key. Enforce idempotency in your own application before sending an initiation request; this result does not rule out other Safaricom mechanisms.
Rank #2
- Get your money as soon as the next business day.
- Get set up quickly with no long-term commitments. Download the Square Point of Sale app for free, create an account, and start taking payments anywhere.
- Run your business all in one place with the free Square Point of Sale app. Track your sales, manage inventory, accept tips, send receipts digitally, and more.
- Works with Apple devices with a Lightning connector.
4. The immediate response did not include AccountReference
The initiation response contained MerchantRequestID, CheckoutRequestID, ResponseCode, ResponseDescription, and CustomerMessage, but not the caller’s AccountReference. Persist the relationship between your order or payment attempt and the identifiers returned by Daraja when you submit the request. Do not rely on the immediate response to reconstruct that link later.
Recommended Free Tools
5. One CheckoutRequestID looked like it contained Nairobi local time
The ID ws_CO_180920261803512708374149 was associated by the recorder with 15:03 UTC; its embedded time reads 18:03:51, which is UTC+3. That single example is not evidence of a stable ID format. Treat CheckoutRequestID as opaque rather than parsing its apparent timestamp.
Rank #3
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
6. Safaricom’s example request used different JSON types for related values
In the example request examined, BusinessShortCode was a JSON number, while Amount and PartyB were strings. PartyB and BusinessShortCode carried the same value but had different JSON types. Match the documented types rather than assuming equivalent numeric meaning makes a number and a string interchangeable. The example alone does not establish whether a type mismatch causes rejection.
7. I saw no callback redelivery after two simulated failures
After an explicit HTTP 500 response, no further callback delivery was observed during the next 31 minutes. When the receiver was unreachable, no further delivery was observed during the next 44 minutes. Those are the measured windows in this sandbox run, not proof that every callback behaves the same way.
Rank #4
- Pay one transparent rate per swipe for Visa, Mastercard, Discover and American Express.
- Works in conjunction with most downloadable Square point-of-sale apps on your device. Customers can pay, tip and sign directly on your device. Track payments in cash, gift cards and more. Also lets you send receipts via e-mail or text message, makes it easy to apply discounts, keeps a data and sales history log and more.
- Accepts magstripe credit card payments, including those from Visa, Mastercard, Discover and American Express (fees apply).
- App sends deposits to your bank account within 1 to 2 business days, or enjoy instant deposits (fees apply).
Safaricom’s integration document says failed callbacks are not repeated and recommends Transaction Status Query or the M-PESA organization portal to confirm a request if callback delivery fails. The document was visible in search excerpts but could not be opened for a fresh full-document review; the recommendation is also consistent with the behavior described above. Build a reconciliation path rather than making callback redelivery your only recovery mechanism.
8. ResultCode appeared more consistent than ResultDesc
Code 1037 appeared across several observations while the accompanying prose varied. Code 4999 appeared once with a description indicating that processing was still underway. In this limited sandbox sample, branching on the code was more consistent than branching on description text. This is not an exhaustive result-code specification: behavior for other codes and unknown codes remains unestablished.
Best Value
- Accept all major credit and debit cards and pay one low rate
- No hidden fees and no long-term contracts
- Mobile card reader that accepts payments anywhere & anytime
- Use the free SumUp App on your smartphone or tablet to start accepting transactions
- Simply pay 2.6% +10 per in-person transaction
What an accepted initiation does—and does not—tell you
An initiation acknowledgment is not evidence of a completed payment. The sandbox payer never answered the prompt, and I have never seen a successful payment in this report. Consequently, the successful callback metadata, receipt number, and payer-MSISDN shape are unknown here; any success path modeled in the simulator is not an observed payment result.
The observations also do not establish production behavior, changes in Daraja 3.0, a complete result-code vocabulary, or how an unfamiliar result code should be interpreted. Keep those cases distinct in your integration rather than filling them in from these runs.
Quick Recap
Implementation decisions these results support
- Initiation: Make duplicate prevention an application responsibility before submission; do not assume repeating
AccountReferencededuplicates a request. - Persistence: Store your order-to-request-ID mapping at initiation, because the immediate response did not carry the original reference in this test.
- Status handling: Represent unresolved results as unknown or pending when a query returns
500.001.1001; do not convert that response directly into a final failure. - Callbacks: Handle the callback when it arrives, but also provide status-query or organization-portal reconciliation for failed delivery, as Safaricom’s integration guidance recommends.
- Security: Redact request bodies from logs because the encoded password includes the passkey in recoverable form.
- Result interpretation: Use result codes for branching in preference to prose descriptions, while retaining an explicit fallback for codes not covered by your implementation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
