M-Pesa integration pitfalls that cost real money

Daraja callbacks fail more than you think. Idempotent, queryable transactions plus a reconciliation cron are non-negotiable.

A retry without idempotency means double-charged customers. Always design around an idempotency key the moment a transaction is initiated.

Daraja credentials in env files committed to a repo is one of the most common breaches we see. Use a real secret manager, vaulted access, and rotation.

Reconciliation is at least half of any real M-Pesa engagement. Automate it from day one. Your finance team will thank you.

Daraja error codes are surprisingly precise. Map and surface them — don't generalize to 'payment failed'.

Sandbox is permissive; production is not. Bulk B2C disbursements without rate-limit handling will silently start failing.

Every state transition for every transaction should be logged. When Safaricom or your auditor asks questions, you need answers ready in 30 seconds.