paylod
SDKs & libraries

Libraries & tools

M-Pesa SDKs and libraries for paylod

.md

Every official paylod client — Node, PHP (Laravel-ready), Python, Java and Kotlin — plus the WooCommerce plugin. All mirror the same surface: collect, collectAndWait, check, verifyWebhook, decodeError.

paylod ships an official client for every runtime that a Kenyan checkout tends to run on. They are all wrappers over the same HTTP API documented in the API reference, and every one of them mirrors the same surface — collect, collectAndWait, check, verifyWebhook, decodeError — so the code below reads the same shape whichever language you pick. Use the language picker in the top-left to switch every sample on this page (and across the docs) at once.

Not on this list? The API is plain HTTP with a bearer token — call it directly. The quickstart and the API reference both show the raw cURL.

Official SDKs

LanguageInstallRepository
Node / TypeScriptnpm install @paylod/nodegithub.com/mosesmrima/paylod-node
PHP (Laravel-ready)composer require paylod/paylodgithub.com/mosesmrima/paylod-php
Pythonpip install paylodgithub.com/mosesmrima/paylod-python
Javadev.paylod:paylod (Maven / Gradle)github.com/mosesmrima/paylod-java
Kotlindev.paylod:paylod (Gradle)github.com/mosesmrima/paylod-kotlin

The Node client has the deepest reference — Node SDK — and the others track it method for method. Where a language has its own idiom, the SDK uses it: Python exposes collect_and_wait, verify_webhook and decode_error; the others keep the collectAndWait / verifyWebhook / decodeError spelling.

[!note] The PHP client is framework-agnostic and ships a Laravel service provider and facade, so on Laravel you can resolve Paylod from the container and read config from config/paylod.php instead of constructing it by hand.

Install

npm install @paylod/node

Initialize the client

One argument: your API key. There is no base URL to configure and no OAuth token to refresh.

import { Paylod } from "@paylod/node";

export const paylod = new Paylod(process.env.PAYLOD_API_KEY!);

The API key can move money, so it is a server-side secret. Never ship it in a browser, a mobile app, or anything a payer can open. See Secure integration.

Collect a payment

collectAndWait sends the STK Push and polls until the payment settles, then hands back a PaymentOutcome: a customer-facing message (already decoded) and a retryable flag.

const outcome = await paylod.collectAndWait({
  amount: 100,
  phone: "0712345678",
  idempotencyKey: attempt.id,   // one key per payment attempt — a double-click cannot charge twice
});

if (outcome.paid) fulfil(outcome.receipt);
else console.log(outcome.message);

Check a payment

check reads a payment and decodes it into the same renderable PaymentOutcome. This is what a polling endpoint in your own app should return to its frontend.

const outcome = await paylod.check(paymentId);
outcome.status;   // "pending" | "succeeded" | "cancelled" | "failed"
outcome.message;  // renderable, already decoded

Verify a webhook

Every SDK verifies the x-webhook-signature header — HMAC-SHA256 over t + "." + rawBody — and returns a typed event. Pass the raw request bytes, not a re-serialised object. The scheme is documented under Webhooks.

const event = paylod.verifyWebhook({
  payload: rawBody,
  signature: headers["x-webhook-signature"],
  secret: process.env.PAYLOD_WEBHOOK_SECRET,
});

Decode an error

Turn a raw M-Pesa result code into a decoded, renderable error — offline, no network call. You rarely need this directly (check and collectAndWait already return a decoded message); it is here for logs, dashboards and support tooling. The whole catalogue is browsable in the error reference.

const err = paylod.decodeError(1032);
// err.title, err.cause, err.fix, err.category, err.retryable, err.customerMessage

Plugins

PluginPlatformRepository
paylod for WooCommerceWordPress / WooCommercegithub.com/mosesmrima/paylod-woocommerce

The WooCommerce plugin adds M-Pesa as a checkout method: install it, paste an mp_live_… key, and the STK Push, the hosted callback and the order-status update are all handled for you — no code. It is the fastest way to take M-Pesa on an existing WordPress store.

Next

  • The deepest per-method reference: Node SDK.
  • The HTTP endpoints underneath every SDK: API reference.
  • Prefer the terminal? The CLI sends the same STK Push in one command.
  • Every result code, decoded: error reference.