M-Pesa STK Push Explained for Business Owners

If you have paid for something online in Kenya, you have probably used STK Push: you enter your phone number, a prompt appears on your phone, you enter your PIN and the payment is done. For businesses, it is the smoothest way to accept M-Pesa online. Here is how it works and what to know before using it.

What is M-Pesa STK Push?

STK stands for SIM Toolkit, the menu system on your SIM card that M-Pesa uses. STK Push means the payment request is pushed from the business to the customer's phone, instead of the customer navigating the M-Pesa menu and typing details. Safaricom offers it through its Daraja API, where it is known as Lipa na M-Pesa Online or M-Pesa Express.

How does STK Push work?

1. The customer chooses M-Pesa at checkout and confirms their phone number.
2. Your server sends a request to Safaricom with the amount, phone number and a reference.
3. The customer's phone shows a prompt with your business name and the amount.
4. The customer enters their M-Pesa PIN to approve, or cancels.
5. Safaricom sends the result to your server.
6. Your system updates the order and notifies the customer and your team.

Why is STK Push better than manual Paybill payments?

Manual Paybill or Till	STK Push
Customer leaves your site to open M-Pesa	Prompt appears while they stay on your site
Types Paybill number, account and amount	Only enters their PIN
Typing mistakes cause wrong or unmatched payments	Amount and reference are pre-filled
Staff confirm payments manually	Confirmation is automatic
Order waits for confirmation	Order confirmed in seconds

Where can businesses use STK Push?

• Online store checkouts.
• Booking deposits for hotels, tours, salons and clinics.
• School fees and membership contributions through portals.
• Invoice payments from a payment link.
• Event tickets and registrations.
• Subscription renewals, with the customer approving each payment.

What do you need to use STK Push?

• A business Paybill or Till number registered for Lipa na M-Pesa.
• A Daraja developer account and production approval for your shortcode.
• A secure server with a public HTTPS callback address.
• Code that sends requests, receives results and updates your records.

What can go wrong, and how do you handle it?

• Timeouts: the customer does not respond in time. Show a clear message and a "resend prompt" option.
• Cancelled or wrong PIN: the payment fails. Let the customer try again without re-entering everything.
• Delayed callbacks: query the transaction status if no result arrives.
• Duplicate callbacks: process each transaction only once.
• Wrong number: let customers correct the number before sending.
• Phone off or no network: offer an alternative, such as paying to your Paybill with the order reference, which your system can still match automatically.

Is STK Push secure?

Yes, when implemented correctly. The customer approves every payment with their own PIN on their own phone; your website never sees the PIN. On your side, API credentials must be stored securely on the server, callbacks validated and every transaction logged.

How do customers experience it on a good checkout?

A well-designed checkout tells customers exactly what to expect: "Check your phone for an M-Pesa prompt and enter your PIN." It shows a waiting state, confirms success clearly and sends an SMS or WhatsApp receipt. Small details like these reduce anxiety and abandoned payments.

Can STK Push be used outside a website checkout?

Yes. Because the prompt is triggered by your server, it can be sent from anywhere your system runs: a staff tablet at a counter, a WhatsApp ordering flow, a payment link in an SMS or email, or a customer portal. For example, a delivery rider can trigger a prompt for the customer's balance at the door, and the payment is recorded against the order automatically.

Example: STK Push for event tickets

A conference sells tickets online. Attendees choose a ticket type, enter their phone number and approve the STK Push prompt. Once payment is confirmed, the system issues a ticket with a QR code by email and SMS. At the door, staff scan the code. No one has to match M-Pesa messages to names, and the organisers see real-time sales in a dashboard.

Add STK Push to your website or app

Our M-Pesa integration service builds STK Push with status checks, retries and reconciliation. Read how to integrate M-Pesa into your website for the bigger picture.