What Daraja 3.0 actually changed for developers — and what it did not.
Safaricom launched Daraja 3.0 on November 25, 2025, at the M-Pesa Integrators Forum in Nairobi. The press release mentioned cloud-native architecture, Security APIs, Mini App support, and a self-service onboarding model replacing the old paper-based process. 105,000 registered developers. The biggest M-Pesa API update since Daraja 2.0 launched in 2019.
Most of the coverage repeated the press release. This post does not.
What actually changed
The platform underneath changed. Daraja 3.0 moved to a cloud-native, microservices-based architecture. Safaricom claims capacity for up to 12,000 transactions per second — a significant ceiling lift over the previous architecture. The developer portal was redesigned. Self-service onboarding is now available, meaning you can go live without the old manual approval process that required back-and-forth with Safaricom's integration team.
New API categories were added:
Ratiba — scheduled and recurring payments. Daily, weekly, monthly, yearly billing cycles. This is new. There was no recurring payment API in Daraja 2.0.
Security APIs — fraud detection, prevention, identity verification. Limited public documentation available.
IoT APIs — payments for connected devices. Limited public documentation available.
Mini App platform — build lightweight apps that run inside the M-Pesa Super App. Built on Ant Group's Mini Program framework, the same technology that powers Alipay mini-apps. A separate IDE, a JavaScript-based SDK, a submission and approval process. This is a different ecosystem from anything that existed before.
What did not change
The STK Push endpoint path is the same: /mpesa/stkpush/v1/processrequest.
The OAuth token endpoint is the same: /oauth/v1/generate.
The callback payload structure is the same: Body.stkCallback, MerchantRequestID, CheckoutRequestID, ResultCode, CallbackMetadata.Item.
The base URLs are the same: sandbox.safaricom.co.ke for sandbox, api.safaricom.co.ke for production.
The authentication model is the same: base64-encoded Consumer Key and Consumer Secret, standard OAuth2 client credentials flow.
Existing Daraja 2.0 integrations do not break. If your code hits the STK Push endpoint and handles callbacks correctly, it continues to work on Daraja 3.0 infrastructure without modification. Safaricom was deliberate about backward compatibility on the core payment flows.
What changed at the developer portal level
Mandatory 2FA to access documentation. This sounds minor. It is not minor when you are trying to quickly look up a parameter while debugging at 11 p.m. and your authenticator app is on a different device.
Self-service onboarding. Previously, going live required manual review by Safaricom's team. The timeline was unpredictable. Self-service removes that bottleneck entirely.
The AI support chatbot. Community feedback is mixed. It answers common questions but struggles with edge cases and often redirects to the same documentation pages that didn't answer the question in the first place.
The sandbox problem
The Daraja 3.0 sandbox is unstable for failure-state testing. Connections drop. The environment runs almost exclusively in success mode — STK Pushes succeed, callbacks arrive, ResultCode is 0.
What you cannot test in the official sandbox: insufficient funds (ResultCode 1), wrong PIN exhaustion (ResultCode 2001), USSD timeout (ResultCode 1037), cancelled by user (ResultCode 1032), request in progress (ResultCode 1025).
Developers who only test against the official sandbox ship code that has never encountered a real failure mode. Production is where they find out what ResultCode 1032 looks like. Production is not the right place to find that out.
Pesa Playground, released December 2025, exists specifically to fix this. It runs offline, simulates the full mini-economy with persistent balances, and supports every failure state the official sandbox cannot. It is community-built, actively maintained, and the closest thing to a reliable local development environment the Daraja ecosystem has. If you are building on Daraja and not using Pesa Playground for failure-state testing, you are testing with one hand behind your back.
The Mini App platform — a separate conversation
The Mini App platform deserves separate treatment because it is not an extension of the existing Daraja API. It is a different product.
Mini Apps are JavaScript-based. They run inside the M-Pesa Super App container. The SDK is from Ant Group's Mini Program framework — the same technology powering Alipay's mini-app ecosystem. Development happens in a proprietary IDE called Mini Program Studio. The submission and approval process mirrors the WeChat/Alipay model.
If you are a Flutter developer expecting to build a Mini App in Dart, the answer is no. The two ecosystems do not intersect. Mini App development is JavaScript. Flutter is not involved.
There are already 80+ Mini Apps live in the M-Pesa Super App across Kenya, Lesotho, Ethiopia, and Mozambique. The platform is real and active. It is also completely separate from anything discussed in the Daraja API documentation, and Safaricom does not make this distinction prominently in their Daraja 3.0 marketing.
The honest summary
Daraja 3.0 is a platform upgrade, not an API overhaul. The developer experience has improved meaningfully — self-service onboarding is genuinely better, the capacity improvements are real, Ratiba is a net-new capability that was missing for years.
The core STK Push flow, the callback architecture, the asynchronous delivery model, the sandbox limitations — these are unchanged. The fundamental integration challenges that make M-Pesa difficult to build on correctly are the same in Daraja 3.0 as they were in Daraja 2.0.
There are no community SDKs updated for Daraja 3.0. There are no Flutter packages targeting the new endpoints. The only Daraja 3.0 SDK in existence is a C# library published March 2026.
The gap between what Daraja 3.0 makes possible and what the tooling ecosystem currently supports is wide. It will not close on its own.
Research conducted April 2026. Sources: Safaricom press release Nov 25 2025, TechCabal, TechArena, Techweez, developer.safaricom.co.ke, mpesaminiapps.safaricom.co.ke, github.com/OmentaElvis/pesa-playground. Daraja portal requires authenticated login for full API catalog.
Tags: mpesa flutter dart webdev
