Success

The STK Push transaction completed and the customer's payment was received successfully.

Insufficient balance

The customer does not have enough M-Pesa balance (including any available Fuliza overdraft) to cover the amount.

Unable to process by Party B

The receiving shortcode (Party B) or Safaricom's system was temporarily unable to process the transaction.

System busy

M-Pesa is under high load and rejected the request because the system was busy.

Unable to lock subscriber / transaction in progress

The customer already has an active USSD or M-Pesa session processing another transaction, so a new one cannot be started.

Transaction expired

The transaction exceeded its allowed processing window because the customer took too long to respond.

Error while sending push / message too long

M-Pesa could not send the STK prompt, often because the TransactionDesc exceeds 182 characters or a temporary system issue occurred.

Error sending push (request character limit)

The push could not be delivered, commonly because the request message exceeds the 182-character limit.

Request cancelled by user

The customer received the STK/USSD prompt but pressed Cancel instead of entering their PIN.

Timeout / user cannot be reached

The STK prompt could not reach the phone or the customer did not respond within the timeout, often due to the phone being off or poor coverage.

Wrong PIN / invalid initiator information

Authorization failed because the customer entered the wrong M-Pesa PIN (or the initiator credentials were invalid).

Bad Request - Invalid BusinessShortCode / Invalid Amount

The synchronous request was rejected as malformed, commonly due to an invalid shortcode, invalid amount, or the payload being sent as form data instead of JSON.

Invalid Request Payload

The request payload is structurally invalid or missing required fields, so Daraja returns HTTP 400 before processing.

Invalid PhoneNumber

The PhoneNumber/PartyA value is not a valid Safaricom MSISDN in the required 2547XXXXXXXX international format.

Unauthorized - invalid or expired access token

The OAuth access token is missing, malformed, or expired (tokens have a ~1 hour TTL), returning HTTP 401.

Invalid Access Token

Daraja reports the access token as invalid on HTTP 404; often the token is actually fine but the shortcode is not authorized/whitelisted for that specific API.

Invalid Authentication Header

The Authorization header is missing or incorrectly formatted, so the request cannot be authenticated (HTTP 404).

Server Error / merchant does not exist or insufficient funds

A server-side error (HTTP 500), commonly a nonexistent merchant/shortcode or, for B2C, insufficient funds in the business account.

Service temporarily unavailable / under maintenance

The Daraja service is temporarily unavailable, throttled (spike arrest), or under maintenance, returning HTTP 500.

Success / Accepted

The C2B/B2C/Reversal/Transaction Status/Account Balance request was processed successfully (for C2B validation this is the 'Accept' response).

The initiator information is invalid

For B2C and other secured APIs, the initiator username/encrypted SecurityCredential does not match the shortcode or has expired.

Invalid MSISDN (Reject)

During C2B validation the payer's phone number (MSISDN) is considered invalid by your validation logic.

Invalid Account Number (Reject)

During C2B validation the account number / bill reference supplied by the payer does not exist in your system.

Invalid Amount (Reject)

During C2B validation the paid amount fails your rules (for example wrong amount for the invoice).

Invalid KYC Details (Reject)

During C2B validation the payer's KYC details do not meet your requirements.

Invalid Shortcode (Reject)

During C2B validation the shortcode targeted by the payment is considered invalid.

Other Error (Reject)

A catch-all C2B validation rejection for any other reason not covered by the specific reject codes.