One API key for M-Pesa collections and payouts
PesaBridge handles the payment network plumbing for you. Create an app, copy your secret key, and start collecting from customers or paying them out.
- < 60s
- From sign-up to first payment prompt
- 5 retries
- Signed webhook delivery with backoff
- 100%
- Immutable ledger of every transaction
How it works
You integrate against one clean REST surface. We hold the network credentials, receive results on a stable HTTPS endpoint and relay them to your own webhook.
1. Create an app
Every app gets a publishable key, a secret key shown once, a signing secret and its own account reference prefix used to attribute callbacks back to you.
2. Call the API
POST /v1/stkpush to prompt a customer, POST /v1/b2c to pay one out. Send an Idempotency-Key and network retries can never double-charge.
3. Receive the result
We store the result in your ledger and POST a signed payload to your webhook URL, retrying with exponential backoff until you 2xx.
Built for real Kenyan businesses
Whether you run an agri-marketplace paying farmers out weekly, a delivery app collecting on arrival, or a SaaS billing monthly — the same two endpoints cover collections and payouts.
- Sandbox and live environments per app
- Secrets hashed at rest, shown once, rotatable
- Per-key rate limiting and full audit log
- Poll /v1/transactions/:id if you prefer no webhooks
curl https://api.pesabridge.app/api/public/v1/stkpush \
-H "Authorization: Bearer sk_test_xxx" \
-H "Idempotency-Key: order_10231" \
-H "Content-Type: application/json" \
-d '{
"amount": 250,
"phone": "254708374149",
"accountReference": "ORDER-10231",
"description": "Farm inputs"
}'Security is not an add-on
Bearer secret keys are stored only as salted SHA-256 digests. Each webhook delivery carries an HMAC-SHA256 signature over the raw body so you can verify it came from us. Every API call is written to a per-tenant request log with its status code and latency, and row-level security keeps one tenant's data unreachable from another.
Plans & pricing
Pick a plan when you request your API key. Access stays active for the full duration you choose.
Loading plans…