Libraries & tools
M-Pesa SDKs and libraries for paylod
Every official paylod client — Node, PHP (Laravel-ready), Python, Java and Kotlin — plus the WooCommerce plugin. All mirror the same surface: collect, collectAndWait, check, verifyWebhook, decodeError.
paylod ships an official client for every runtime that a Kenyan checkout tends to run on. They are all wrappers over the same HTTP API documented in the API reference, and every one of them mirrors the same surface — collect, collectAndWait, check, verifyWebhook, decodeError — so the code below reads the same shape whichever language you pick. Use the language picker in the top-left to switch every sample on this page (and across the docs) at once.
Not on this list? The API is plain HTTP with a bearer token — call it directly. The quickstart and the API reference both show the raw cURL.
Official SDKs
| Language | Install | Repository |
|---|---|---|
| Node / TypeScript | npm install @paylod/node | github.com/mosesmrima/paylod-node |
| PHP (Laravel-ready) | composer require paylod/paylod | github.com/mosesmrima/paylod-php |
| Python | pip install paylod | github.com/mosesmrima/paylod-python |
| Java | dev.paylod:paylod (Maven / Gradle) | github.com/mosesmrima/paylod-java |
| Kotlin | dev.paylod:paylod (Gradle) | github.com/mosesmrima/paylod-kotlin |
The Node client has the deepest reference — Node SDK — and the others track it method for method. Where a language has its own idiom, the SDK uses it: Python exposes collect_and_wait, verify_webhook and decode_error; the others keep the collectAndWait / verifyWebhook / decodeError spelling.
[!note] The PHP client is framework-agnostic and ships a Laravel service provider and facade, so on Laravel you can resolve Paylod from the container and read config from config/paylod.php instead of constructing it by hand.
Install
npm install @paylod/nodeInitialize the client
One argument: your API key. There is no base URL to configure and no OAuth token to refresh.
import { Paylod } from "@paylod/node";
export const paylod = new Paylod(process.env.PAYLOD_API_KEY!);The API key can move money, so it is a server-side secret. Never ship it in a browser, a mobile app, or anything a payer can open. See Secure integration.
Collect a payment
collectAndWait sends the STK Push and polls until the payment settles, then hands back a PaymentOutcome: a customer-facing message (already decoded) and a retryable flag.
const outcome = await paylod.collectAndWait({
amount: 100,
phone: "0712345678",
idempotencyKey: attempt.id, // one key per payment attempt — a double-click cannot charge twice
});
if (outcome.paid) fulfil(outcome.receipt);
else console.log(outcome.message);Check a payment
check reads a payment and decodes it into the same renderable PaymentOutcome. This is what a polling endpoint in your own app should return to its frontend.
const outcome = await paylod.check(paymentId);
outcome.status; // "pending" | "succeeded" | "cancelled" | "failed"
outcome.message; // renderable, already decodedVerify a webhook
Every SDK verifies the x-webhook-signature header — HMAC-SHA256 over t + "." + rawBody — and returns a typed event. Pass the raw request bytes, not a re-serialised object. The scheme is documented under Webhooks.
const event = paylod.verifyWebhook({
payload: rawBody,
signature: headers["x-webhook-signature"],
secret: process.env.PAYLOD_WEBHOOK_SECRET,
});Decode an error
Turn a raw M-Pesa result code into a decoded, renderable error — offline, no network call. You rarely need this directly (check and collectAndWait already return a decoded message); it is here for logs, dashboards and support tooling. The whole catalogue is browsable in the error reference.
const err = paylod.decodeError(1032);
// err.title, err.cause, err.fix, err.category, err.retryable, err.customerMessagePlugins
| Plugin | Platform | Repository |
|---|---|---|
| paylod for WooCommerce | WordPress / WooCommerce | github.com/mosesmrima/paylod-woocommerce |
The WooCommerce plugin adds M-Pesa as a checkout method: install it, paste an mp_live_… key, and the STK Push, the hosted callback and the order-status update are all handled for you — no code. It is the fastest way to take M-Pesa on an existing WordPress store.
Next
- The deepest per-method reference: Node SDK.
- The HTTP endpoints underneath every SDK: API reference.
- Prefer the terminal? The CLI sends the same STK Push in one command.
- Every result code, decoded: error reference.