內容簡介
Marupurupu Checkout for M-Pesa 外掛使您能夠透過 M-Pesa (Safaricom) 接受付款，利用 STK Push (Lipa Na M-Pesa Online) 功能，並與 WooCommerce 無縫整合，支援傳統和區塊型結帳方式。
【主要功能】
• STK Push 付款提示直接發送至客戶手機
• 支援 WooCommerce 區塊型結帳
• 完全相容傳統短碼結帳
• 自動偵測結帳類型
• 實時付款狀態確認
• 交易報告與管理儀表板
外掛標籤
開發者團隊
② 後台搜尋「Marupurupu Checkout for M-Pesa」→ 直接安裝（推薦）
原文外掛簡介
Marupurupu Checkout for M-Pesa allows you to accept payments via M-Pesa (Safaricom) using the STK Push (Lipa Na M-Pesa Online) feature. This plugin integrates seamlessly with WooCommerce and supports both classic shortcode-based checkout and modern block-based checkout.
Independent plugin — no affiliation. This plugin is developed independently. It is not affiliated with, endorsed by, or sponsored by Safaricom, M-Pesa, WooCommerce or Automattic. M-Pesa, Safaricom and WooCommerce are trademarks of their respective owners, used here only to describe what the plugin works with.
Features
STK Push Payments – Customers receive payment prompt directly on their phone
Block Checkout Support – Works with WooCommerce block-based checkout (NEW in v1.1.0)
Classic Checkout Support – Fully compatible with traditional shortcode checkout
Automatic Detection – Automatically works with both checkout types
Real-time Payment Status – Instant payment confirmation via callbacks
Transaction Reports – Comprehensive admin dashboard for transaction tracking
Secure Credentials – AES-256-GCM authenticated encryption for M-Pesa API credentials
Test Mode – Sandbox environment for testing before going live
Payment Callbacks – Automatic order status updates
Order Tracking – Enhanced order received page with payment status
Debug Logging – Detailed logs for troubleshooting
Telemetry – Optional usage tracking (opt-in)
Requirements
WordPress 5.3 or higher
WooCommerce 3.0 or higher (5.5+ recommended for block checkout)
PHP 7.4 or higher
SSL Certificate (required for M-Pesa STK Push)
M-Pesa Till Number and Daraja API credentials
Setup
Upload the plugin to /wp-content/plugins/marupurupu-checkout-for-mpesa/
Activate the plugin through the ‘Plugins’ menu in WordPress
Go to WooCommerce > Settings > Payments
Enable “M-Pesa Till Payment”
Click “Manage” to configure your M-Pesa credentials
Add your Business Short Code (Till Number), Consumer Key, Consumer Secret, and Passkey
Configure callback URL (auto-generated)
Save changes and test in Test Mode first
Configuration
Required Settings:
* Consumer Key (Production & Test)
* Consumer Secret (Production & Test)
* Business Short Code (Your Till Number)
* Passkey (From Daraja Portal)
* Test Mode toggle
Optional Settings:
* Payment instructions for customers
* Debug logging
* Telemetry (usage tracking)
External services
This plugin connects to the third-party services below. Nothing is sent to Safaricom until you configure the plugin and a payment is attempted, and nothing is sent to the usage-statistics collector unless you opt in.
Safaricom Daraja API (api.safaricom.co.ke, or sandbox.safaricom.co.ke when Test Mode is on) — the service that actually takes the M-Pesa payment.
* Used for: requesting an access token, sending an STK Push payment prompt to the customer’s phone, and checking the status of a payment. Safaricom also posts the payment result back to your site’s callback URL.
* Sent, and when: your Consumer Key and Consumer Secret (to obtain a token — whenever one is needed and when you click “Test M-Pesa Connection”); and, when a customer pays, your Business Short Code and Till Number, a request password derived from your Passkey, the order amount, the customer’s M-Pesa phone number, an order reference (“Order-” plus the order number) and your site’s callback URL.
* Provider: Safaricom PLC. Daraja developer portal: https://developer.safaricom.co.ke/ — Terms and Conditions and Privacy Policy: https://developer.safaricom.co.ke/terms
Plugin usage-statistics collector (telemetry.billtoolbox.com) — optional and off by default; used only if you tick “Help improve this plugin by sharing anonymous usage data” in the gateway settings. Exactly what is sent, and when, is listed field by field under “Privacy Policy” below. Operated by the plugin author. It has no separate terms document: the complete disclosure of what it receives, stores and for how long is the “Privacy Policy” section below.
WordPress.org secret-key generator (api.wordpress.org/secret-key/1.1/salt/) — only a link in an admin notice shown when your site’s security keys are missing. The plugin sends nothing to it; your browser opens it only if you click the link.
Technical Details
Compatibility
WordPress: 5.3+
WooCommerce: 3.0+ (5.5+ for block checkout)
PHP: 7.4, 8.0, 8.1, 8.2
WooCommerce Blocks: 11.0+
Security
AES-256-GCM authenticated encryption for stored credentials (detects tampering/wrong-key decryption cryptographically, not by guessing)
Nonce verification for all forms
Input sanitization and output escaping
SQL injection prevention
XSS protection
Callback authentication via a per-site secret token
Callback payment amount verified against the original order before marking paid
Rate limiting on the customer-facing payment-retry endpoint
Performance
Minimal database queries
Efficient caching
Optimized asset loading
No frontend JavaScript unless on checkout page
Privacy Policy
This plugin:
* Stores M-Pesa transaction data in your WordPress database
* Sends payment requests to Safaricom M-Pesa API
* Optionally tracks anonymous usage data (opt-in telemetry) — see below
* Does not share customer data with third parties (except Safaricom for payment processing)
* Encrypts sensitive credentials at rest
Telemetry (opt-in)
Anonymous usage telemetry is off by default. It only activates if you
check “Help improve this plugin by sharing anonymous usage data” under
WooCommerce > Settings > Payments > M-Pesa Till > Anonymous Usage Data, and
stops sending anything as soon as you uncheck it (any leftover scheduled
tasks then do nothing). If you had opted in, deactivating the plugin sends one final deactivation event (described below).
Site identifier: every event includes a site_id — a SHA-256 hash of
your site’s URL. This is a stable, unique-per-install pseudonymous
identifier, not full anonymity: because it’s stable, events from your site
can be correlated with each other over time (e.g. to see version-upgrade
history), even though your actual site URL, domain, or any other
identifying detail is never transmitted.
What’s sent, by event type (the feature_usage, error and performance events are supported by the code but the plugin does not currently trigger them; they are listed so the disclosure stays complete if that changes):
heartbeat (weekly) — WordPress, WooCommerce, PHP, and MySQL version
numbers; server software string; PHP memory limit and max execution
time; whether OpenSSL and cURL are available; whether High-Performance
Order Storage (HPOS) is enabled; site language and timezone; whether the
site is a WordPress Multisite install; whether stored M-Pesa credentials
are encrypted (a boolean only — never the credentials themselves).
daily_stats (daily) — transaction counts by status (completed/pending/
failed), success rate, minimum/maximum/average transaction amounts,
and a distribution of M-Pesa result/failure codes. No order IDs, phone
numbers, or customer identities are included — only aggregate numbers.
feature_usage (weekly aggregate) — which plugin features were used and
how many times, with no reference to which orders/customers triggered
them.
error — an error category and code (e.g. api_error / 1037), plus a
short sanitized context string. The context field only ever contains the
fixed category labels already used internally by the plugin’s error
tracking — never raw request bodies, stack traces, or user input.
performance (weekly aggregate) — timing metrics (count/min/max/average
duration in milliseconds) for named internal operations, with no
reference to which orders they came from.
deactivation — sent once when the plugin is deactivated (and only if you
had opted in): just the event name, the anonymous site identifier, the
plugin version and a timestamp. No event is sent on activation.
Never included, in any event, ever: phone numbers, order details,
customer names or addresses, or M-Pesa credentials (Consumer Key/Secret,
Passkey, callback secret) in any form.
Telemetry, when enabled, is sent to a dedicated collector endpoint operated
by the plugin author (telemetry.billtoolbox.com) — a separate WordPress
install used only for this purpose, isolated from any other site.
Also recorded by the collector: like any web server, it receives the IP
address of the server that sends each event, and stores it with the event. It
is used only for rate limiting and abuse investigation and is not shown on the
collector’s dashboard. Events (including that IP address) are currently kept
until they are deleted manually — there is no automatic expiry. To have the
events for your site removed, ask in this plugin’s support forum on
WordPress.org and include your site’s identifier (site_id: the SHA-256 hash
of your site URL described above).
Credits
Developed by: Martin Mburu
Based on: Safaricom Daraja API
Uses: WooCommerce Payment Gateway API
Blocks Integration: WooCommerce Blocks API
Third-party libraries
Chart.js 4.5.1 (MIT License) — draws the charts on the Reports page. Bundled locally as assets/js/chart.umd.js (the library’s own official minified build, unmodified). Human-readable source: https://github.com/chartjs/Chart.js (the v4.5.1 tag) or https://www.npmjs.com/package/chart.js/v/4.5.1.
Additional Information
Source code: https://github.com/marto-karanja/marupurupu-checkout-for-mpesa
API Reference: https://developer.safaricom.co.ke/docs
WooCommerce Blocks: https://woocommerce.com/checkout-blocks/
This plugin is not officially affiliated with, endorsed by, or sponsored by Safaricom or M-Pesa. It integrates with Safaricom’s publicly documented Daraja API.
Support
Need help?
1. Read the FAQ above.
2. Turn on WordPress debug logging (WP_DEBUG_LOG) and check WooCommerce > Status > Logs (source “mpesa-till-callback”) and wp-content/debug.log.
3. Ask in this plugin’s support forum on WordPress.org, with your WordPress, WooCommerce and PHP versions and the relevant log lines. Never post your Consumer Key, Consumer Secret or Passkey.
