paylod
SDKs & libraries

Libraries & tools

M-Pesa SDKs and libraries for paylod

.md

Every official paylod client — Node, PHP (Laravel-ready), Python, Java and Kotlin — plus the WooCommerce plugin. All mirror the same surface: collect, collectAndWait, check, verifyWebhook, decodeError.

paylod makes an official client for each common runtime of a Kenyan checkout. Each client is a thin wrapper over the HTTP API in the API reference. Each client has the same methods: collect, collectAndWait, check, verifyWebhook and decodeError. Therefore the code below has the same shape in each language. Use the language picker in the top-left corner to switch all the samples on this page and in the docs at the same time.

paylod publishes only the Node client today. For each other language, the samples on this page show a client that is still in development. The HTTP API below those samples works now. The cURL tab shows that HTTP API.

Your language may not be on this list. The API is plain HTTP with a bearer token, so you can call the API directly. The quickstart and the API reference both show the raw cURL.

Official SDKs

LanguageStatusInstallRepository
Node / TypeScriptReleasednpm install @paylod/nodegithub.com/mosesmrima/paylod-sdk
PHP (Laravel-ready)In developmentNot published yet — use the HTTP APIgithub.com/mosesmrima/paylod-php
PythonIn developmentNot published yet — use the HTTP APIgithub.com/mosesmrima/paylod-python
JavaIn developmentNot published yet — use the HTTP APIgithub.com/mosesmrima/paylod-jvm
KotlinIn developmentNot published yet — use the HTTP APIgithub.com/mosesmrima/paylod-jvm

Node is the only client that paylod publishes today. The PHP, Python, Java and Kotlin clients are complete and in test. But none of them is on Packagist, PyPI or Maven Central yet. Therefore no install command for them resolves. The samples below show the methods that those clients will have. Until paylod releases those clients, call the HTTP API directly. The API needs only a bearer token and a JSON body. The cURL tab on each sample shows the exact request.

The Node client has the most complete reference: the Node SDK page. paylod builds the other clients to match the Node client method for method. Each language keeps its own idiom. Python has the methods collect_and_wait, verify_webhook and decode_error. The other languages keep the collectAndWait, verifyWebhook and decodeError spelling.

[!note] The PHP client works with any framework. The PHP client also includes a Laravel service provider and facade. On Laravel you will resolve Paylod from the container and read the config from config/paylod.php. You will not construct the client by hand.

Each SDK repository is public. You can read the source, file an issue, or open a pull request. Java and Kotlin share one repository, paylod-jvm. A public repository is not a release. The unreleased clients still have no install command that resolves. Read the repository, but do not depend on it.

Install

npm install @paylod/node

Initialize the client

Never put the API key in a browser, a mobile app, or any other program that a customer can open. The API key can move money. Therefore the API key is a server-side secret. See Secure integration.

The client takes one argument: your API key. You set no base URL, and you refresh no OAuth token.

import { Paylod } from "@paylod/node";

export const paylod = new Paylod(process.env.PAYLOD_API_KEY!);

Collect a payment

collectAndWait sends the STK Push. Then collectAndWait polls until the payment settles. Then collectAndWait returns a PaymentOutcome. The PaymentOutcome contains a decoded message for the customer and a retryable flag. retryable=true means that you can safely charge the customer again. retryable=false means that paylod cannot prove that no debit occurred, or that the first prompt is still live.

const outcome = await paylod.collectAndWait({
  amount: 100,
  phone: "0712345678",
  idempotencyKey: attempt.id,   // one key per payment attempt — a double-click cannot charge twice
});

if (outcome.paid) fulfil(outcome.receipt);
else console.log(outcome.message);

Check a payment

check reads a payment. check then decodes the payment into the same PaymentOutcome that you can show to the customer. A polling endpoint in your own application must return this PaymentOutcome to its frontend.

const outcome = await paylod.check(paymentId);
outcome.status;   // "pending" | "succeeded" | "cancelled" | "failed"
outcome.message;  // renderable, already decoded

Verify a webhook

Pass the raw request bytes. Do not pass an object that you serialised again. Each SDK verifies the x-webhook-signature header and returns a typed event. The header is an HMAC-SHA256 over t + "." + rawBody. The Webhooks page documents this scheme.

const event = paylod.verifyWebhook({
  payload: rawBody,
  signature: headers["x-webhook-signature"],
  secret: process.env.PAYLOD_WEBHOOK_SECRET,
});

Decode an error

decodeError turns a raw M-Pesa result code into a decoded error that you can show. decodeError works offline and makes no network call. You rarely need decodeError directly, because check and collectAndWait already return a decoded message. Use decodeError for records, dashboards and support tools. The error reference shows the full catalogue.

const err = paylod.decodeError(1032);
// err.title, err.cause, err.fix, err.category, err.retryable, err.customerMessage

Plugins

PluginPlatformStatusRepository
paylod for WooCommerceWordPress / WooCommerceIn development — not yet downloadablegithub.com/mosesmrima/paylod-woocommerce

Do not install the WooCommerce plugin on a live store. paylod did not release the plugin yet. The repository above is public to read, but you cannot download the plugin.

The WooCommerce plugin adds M-Pesa as a checkout method. You install the plugin and paste an mp_live_… key. The plugin then handles the STK Push, the hosted callback and the order-status update. You write no code. Until paylod releases the plugin, a WordPress store can call the HTTP API. The store can make that call from a small snippet or from any server-side hook.

Next

  • For the most complete per-method reference, see the Node SDK.
  • For the HTTP endpoints below each SDK, see the API reference.
  • To work in the terminal, use the CLI. The CLI sends the same STK Push in one command.
  • For each decoded result code, see the error reference.