Insights / Payments
Safaricom's Daraja 3.0: what actually changed for your M-Pesa payments
Devaltech · 5 min read
Before 2017, a business connecting directly to M-Pesa waited more than sixty days for the integration to go live. Daraja was Safaricom's answer: an API bridge (the name means exactly that) that let a website or app plug into Paybill and Buy Goods payments without the wait. You never deal with Daraja yourself. Whoever built your checkout does. But it is the plumbing behind every M-Pesa payment your site takes, so when it changes, it is worth knowing what changed.
What launched, and when
On 25 November 2025, Safaricom launched Daraja 3.0, its third major version since the original in 2017 and Daraja 2.0 in 2019. The launch was timed to Safaricom's 25th anniversary and framed as a move into what the company calls “Fintech 2.0”. Esther Waititu, Safaricom's Chief Financial Services Officer, called it “a gateway to the next frontier of fintech” at the launch event.
What is actually new
Two changes are concrete enough to matter to a business, not just a developer. First, Security APIs aimed at fraud detection, prevention and identity verification, sitting closer to the payment itself rather than bolted on after. Second, the option for a business to host a service inside the M-Pesa app directly, through something Safaricom calls a Mini Program, instead of only linking out to a separate site. That second one is new and young. Worth knowing it exists, not yet worth rebuilding around.
Beyond those two, most of what Safaricom published is architecture language without a number attached: “cloud-native”, “improved reliability”, “higher uptime”. None of it is false, but none of it is checkable either, so it is not repeated here as if it were.
Your M-Pesa checkout runs on a bridge you never see, until the day it needs upgrading.
Get a free 12-point audit within 48 hours.
What this means if your site already takes M-Pesa
Nothing breaks on its own. Safaricom has not published a retirement date for Daraja 2.0, so an existing integration keeps working. A new integration is worth building on 3.0 from the start, since that is the version Safaricom is now investing in. If you already take M-Pesa online, the one question worth asking whoever runs your integration is whether the new fraud detection layer is switched on for your account, since that is the part of this release that touches you directly rather than the developer building it.