starnerz/laravel-daraja

A Laravel package for the Safaricom M-Pesa Daraja APIs.

v5.0.0 2026-08-18 10:53 UTC

Requires

• php: ^8.3
• ext-json: *
• ext-openssl: *
• guzzlehttp/guzzle: ^7.8
• illuminate/console: ^12.0|^13.0
• illuminate/contracts: ^12.0|^13.0
• illuminate/http: ^12.0|^13.0
• illuminate/support: ^12.0|^13.0
• spatie/laravel-package-tools: ^1.16

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.18
• orchestra/testbench: ^10.0|^11.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-laravel: ^4.0
• rector/rector: ^2.0

MIT

• Stanley Mbaabu

• payments
• laravel
• kenya
• mpesa
• m-pesa
• safaricom
• daraja
• stk-push

Published on Packagist.org on 2026-08-18 11:02 UTC

README

Every Safaricom M-Pesa Daraja API, as ordinary Laravel code. Seventeen APIs — STK Push, C2B, B2C, B2B, Dynamic QR, M-Pesa Ratiba, Bill Manager and the rest — with typed responses, cached tokens, and callbacks you can actually test.

📖 Documentation · Install · STK Push · Going live

Daraja::stk()->push(phone: '0712345678', amount: 1500, accountReference: 'INV-001');

Requirements

• PHP 8.3+
• Laravel 12 or 13

Installation

composer require starnerz/laravel-daraja

DARAJA_MODE=sandbox
DARAJA_CONSUMER_KEY=your-consumer-key
DARAJA_CONSUMER_SECRET=your-consumer-secret
DARAJA_STK_SHORTCODE=174379
DARAJA_STK_PASS_KEY=your-passkey
DARAJA_STK_CALLBACK_URL=https://your-domain/daraja/stk

Verify the credentials:

php artisan daraja:token

Prompt a customer to pay

use Starnerz\LaravelDaraja\Facades\Daraja;

$response = Daraja::stk()->push(
    phone: '0712345678',       // any Kenyan format
    amount: 1500,
    accountReference: 'INV-001',
);

$response->accepted();          // Safaricom sent the prompt
$response->checkoutRequestId;   // identifies this attempt

The payment result arrives later on your callback URL:

use Starnerz\LaravelDaraja\Events\StkCallbackReceived;

Event::listen(function (StkCallbackReceived $event) {
    if ($event->callback->successful()) {
        Order::markPaid(
            $event->callback->checkoutRequestId,
            $event->callback->receipt(),
        );
    }
});

Supported APIs

M-Pesa Express	Daraja::stk()->push() / ->query()
Customer to Business	Daraja::c2b()->registerUrls() / ->simulatePayBill()
Business to Customer	Daraja::b2c()->business() / ->salary() / ->promotion()
Business to Pochi	Daraja::b2c()->pochi()
Business to Business	Daraja::b2b()->payBill() / ->buyGoods() / ->accountTopUp()
B2B Express Checkout	Daraja::b2bExpress()->push()
Account Balance	Daraja::balance()->query()
Transaction Status	Daraja::transaction()->query()
Reversal	Daraja::reversal()->reverse()
Dynamic QR	Daraja::qr()->generate()
M-Pesa Ratiba	Daraja::standingOrder()->create()
Bill Manager	Daraja::billManager()->invoice()
Pull Transactions	Daraja::pull()->query()
Lipa na Bonga	Daraja::bonga()->redeem()

Testing

Built on Laravel's HTTP client, so Http::fake() drives the whole package — no sandbox credentials, network or handset required.

Http::fake([
    '*/oauth/*' => Http::response(['access_token' => 'test']),
    '*/mpesa/stkpush/*' => Http::response(['ResponseCode' => '0']),
]);

See the testing guide.

Upgrading from 4.x

v5 is a rewrite: the facade is now Daraja, responses are typed objects, and several endpoints moved (C2B to v2, B2C to v3). See the upgrade guide.

Laravel 10 and 11 are not supported — both are past end of life and carry unpatched advisories. Applications on those versions should stay on ^4.0.

Contributing

See CONTRIBUTING.md.

Security

Report vulnerabilities to [e-mail] rather than the issue tracker. See SECURITY.md.

Licence

MIT. See LICENSE.