Before 2017, connecting a Kenyan website or digital product directly to Safaricom's M-Pesa network was a bureaucratic ordeal: business owners filled out physical paperwork, submitted bank slips at Safaricom headquarters along Waiyaki Way, waited sixty to ninety days for approval, and wrestled with legacy SOAP XML protocols. Safaricom introduced Daraja (Swahili for “Bridge”) to solve that friction: a modern REST API that let software developers programmatically trigger STK pushes, verify Paybill collections, and disburse payouts.
On 25 November 2025, Safaricom officially launched Daraja 3.0, timed with the telecom's 25th anniversary and framed as the foundation for “Fintech 2.0”. Safaricom's Chief Financial Services Officer, Esther Waititu, heralded the update as a transformative shift into cloud-native payments. But marketing announcements aside, what actually changed for Kenyan e-commerce stores, SaaS founders, and brick-and-mortar merchants?
The three concrete upgrades in Daraja 3.0
Beyond generic promises of “higher uptime” and “cloud-native scale”, three functional upgrades directly impact how commercial payments operate in Kenya:
- 1. Native Security & Fraud Prevention APIs: In earlier Daraja versions, fraud detection was entirely the merchant's problem. Daraja 3.0 introduces native security endpoints that sit directly in front of the transaction. Merchants can now programmatically check SIM-swap risk indicators and account age before initiating high-value transactions, significantly mitigating social engineering and identity theft attacks.
- 2. Resilient callback delivery & retry mechanisms: The single most notorious pain point of Daraja 2.0 was dropped webhook callbacks during national traffic spikes (such as Black Friday or end-of-month paydays). Daraja 3.0 re-engineers callback dispatch on a distributed message queue with automatic exponential backoff retries, ensuring your server receives payment confirmations even during network latency spikes.
- 3. M-Pesa Super App Mini Programs integration: Daraja 3.0 provides the direct API plumbing for businesses to host lightweight web applications directly inside the Safaricom M-Pesa consumer app. Rather than forcing a customer to open Chrome and visit an external URL, the entire shopping and checkout flow can execute within the user's M-Pesa wallet.
Your M-Pesa checkout runs on an API bridge you never see, until the day dropped callbacks leave paid orders unfulfilled.
STK Push, C2B, and B2C: choosing the right endpoint
Understanding Daraja 3.0 requires knowing which payment rails align with your business model:
| Daraja Endpoint | How the Payment Happens | Ideal Use Case | Key Technical Consideration |
|---|---|---|---|
| Lipa Na M-Pesa Online (STK Push) | Website prompts Safaricom to push a PIN prompt onto customer's phone | E-commerce carts, instant booking deposits, subscription renewals | Must handle timeouts (ResultCode: 1037) and cancellations (ResultCode: 1032) gracefully |
| C2B (Customer to Business) | Customer initiates payment via Paybill/Till on their SIM toolkit or M-Pesa app | Bill payment, utility accounts, school fees, manual counter purchases | Requires public Validation and Confirmation webhook URLs with SSL |
| B2C (Business to Customer) | Your business programmatically sends funds from utility balance to customer | Instant refunds, vendor payouts, agent commissions, driver disbursements | Requires Safaricom security credentials (initiator password and public key certificate) |
What this means if your site already takes M-Pesa
If your current website already accepts M-Pesa through Daraja 2.0, nothing will break overnight. Safaricom maintains backwards compatibility and has not announced a deprecation sunset date for 2.0 endpoints. However, any new integration or payment rebuild in 2026 should be built on 3.0 from the start to take advantage of improved token management and callback reliability.
The most immediate action for existing merchants is to audit your callback handling. If your integration does not verify CheckoutRequestID uniqueness or fails to query transaction status during network drops, you are still exposed to dropped order vulnerabilities.
Production Engineering Rule
Always pair Daraja STK Push with an automated Transaction Status Query fallback. If Safaricom's webhook callback is delayed by more than 60 seconds, your backend should query the transaction status programmatically before flagging an order as failed.
How to get started with Daraja 3.0
To build on Daraja 3.0, register an account on the official Safaricom Developer Portal, create a sandbox app, and obtain your Consumer Key and Consumer Secret. From there, your backend engineer can implement OAuth 2.0 authentication, construct the base64-encoded password timestamp, and configure secure HTTPS webhook endpoints.
For a complete breakdown of development costs and gateway comparisons, read our guide on how much M-Pesa integration costs in Kenya or view our custom payment engineering services.