Daraja Agent KitSandbox app and keys
By the end of this track you can make an authenticated call and explain the async model.
0/4 finished
Step 1
The idea
The sandbox is a test copy of Daraja with fake money. You create an app on developer.safaricom.co.ke and get a consumer key and consumer secret. The sandbox shortcode 174379 and its passkey are published on the portal for STK Push tests.
Step 2
How it works
1. Create a developer account
Sign up at developer.safaricom.co.ke and confirm your email. This account is free and only gives sandbox access.
2. Create an app
Under My Apps, create an app and tick the products you want to test, such as M-Pesa Express (STK Push), C2B and B2C. The app page then shows a consumer key and a consumer secret. Together they prove a request comes from you.
3. Note the test values
The portal's simulator page publishes the test shortcode 174379 and its passkey for STK Push. You need both in Collecting money. B2C and the operations APIs also use a test initiator name and password, shown on the same pages.
4. Keep keys out of your code
Put the values in environment variables, or let mpesa init save them to a file outside your project. Your code reads them at start-up. A .env file is fine locally as long as it is listed in .gitignore.
# .env (never committed)DARAJA_ENV=sandboxDARAJA_CONSUMER_KEY=your-consumer-keyDARAJA_CONSUMER_SECRET=your-consumer-secretDARAJA_SHORTCODE=174379DARAJA_PASSKEY=your-sandbox-passkeyStep 3
Try it
Save your keys outside the repo, then check what's configured.
$ mpesa init $ mpesa status
With the MCP server, ask your agent to use mpesa_setup_status
Step 4
Read the response
The environment says sandbox, and the credentials show as set, never their values.
Step 5
Common mistakes
- Committing
.env, or pasting keys into a chat, issue or screenshot. - Mixing sandbox keys with the production host, or the other way round. You get a 400 or 401 and nothing else.
- Sharing one app's keys between projects. Make one app per project, so you can revoke one without breaking the rest.
Go deeper
Why must the consumer secret never go into git?
Answer in your own words first.
Show the answerHide the answer
Anyone who has it can call Daraja as you.