How to integrate mobile money into your app or website

1. Choose between a direct API and an aggregator

There are two ways to accept mobile money:

• Direct operator APIs such as Safaricom's M-Pesa Daraja API, the MTN MoMo API or Orange Money's web payment API. You get lower fees and full control, but you sign up and integrate separately with each operator, often country by country.
• Aggregators such as Paystack, Flutterwave, CinetPay, PayDunya, FedaPay or KkiaPay. One integration gives you several operators and cards, usually across several countries, in exchange for a commission per transaction.

A simple rule: if most of your customers use one operator in one country (for example M-Pesa in Kenya), go direct. If you sell across several countries or operators, an aggregator saves months of work.

2. Open a merchant account

The money lands in your own business account with the operator or aggregator, so you need a merchant account first: a Paybill or Till number for M-Pesa, a merchant account for MoMo or Orange Money, or a business account with the aggregator. Expect to provide company registration documents, ID for the directors and a description of what you sell. Approval can take from a few days to a few weeks, so start early.

3. How a mobile money payment works

Most mobile money APIs follow the same flow:

• Your server authenticates with the provider (usually an OAuth token) using keys that must never appear in your app or website code.
• Your server sends a payment request with the amount, the customer's phone number and a reference. For M-Pesa this is an STK Push: the customer gets a prompt on their phone and enters their PIN. With Wave or a hosted checkout, the customer is redirected to a payment page or opens the Wave app.
• The provider calls your callback URL (webhook) with the result: success, failure or cancellation.
• Your system verifies the callback, updates the order and confirms to the customer. If no callback arrives, you query the transaction status.

4. Test in the sandbox first

Every serious provider offers a test environment. Use it to test successful payments, failed payments, timeouts, duplicate callbacks and refunds before you touch real money. Most production problems come from cases nobody tested: the customer who closes the prompt, the callback that arrives twice, or the network that drops halfway.

5. Security checklist

• Keep API keys and secrets on the server only.
• Verify every callback (signature, IP or a status query) before marking an order as paid.
• Make payment handling idempotent so a repeated callback cannot credit an order twice.
• Log every request and response, and reconcile daily against the provider's report.

6. Reconciliation and accounting

Payments are only finished when the money in your account matches the orders in your system. Plan a daily reconciliation report and an export for your accountant from the start; it is much harder to add later.

7. What it costs

There are two kinds of cost: the provider's transaction fees (a percentage or a fixed fee per payment, set by each operator or aggregator), and the development work, which depends on how many providers you need, whether you also need payouts and refunds, and whether the payment goes into an existing system or a new one.

FAQ

Related service

Payment & Mobile Money Integration