MAA INVEST Pay Docs
Request#
POST https://maainvest.co.ke/pay/start.php · Content-Type: application/x-www-form-urlencoded · sent from the customer's browser. On success the customer is redirected (303) to the hosted checkout. Errors are shown to the customer as a page (see Errors).
Fields#
| Field | Required | Description |
|---|---|---|
merchant_id | yes | Your Merchant ID (MRT… sandbox, MRC… live). |
invoice_id | yes | Your order or invoice reference. 1 to 64 characters: letters, digits, . _ -. |
amount | yes | KES, e.g. 1500.00. Between 1 and 250,000. M-Pesa only takes whole shillings, so cents are rounded up when the prompt is sent (1500.50 becomes a KES 1,501 prompt). |
currency | yes | Must be KES. |
description | yes | Shown to the customer at checkout (keep it under 200 characters). |
return_url | yes | Where the customer goes after paying. http or https, no credentials in the URL. |
cancel_url | yes | Where the customer goes if they cancel or the checkout expires. |
notify_url | yes | Public HTTPS URL that receives the webhook (no private or local addresses, no redirects). |
customer_phone | yes, may be empty | Pre-fills the checkout. Send an empty string if unused. |
customer_email | yes, may be empty | Stored with the checkout. Send an empty string if unused. |
timestamp | yes | Unix seconds. Requests more than 30 minutes away from our clock are rejected. |
signature | yes | HMAC-SHA256 hex, see Signing. |
All fields must be present in the form, even the optional ones (as empty strings), because they are all part of the signature.
Rules to know#
- A checkout stays payable for 1 hour. A customer gets up to 5 prompts per checkout, at least 15 seconds apart.
- Posting the same
invoice_idandamountagain returns the existing open (or already paid) checkout instead of creating a duplicate. A different amount creates a new checkout. - Only the secret holder can create a checkout: never put the API secret in browser code or a mobile app. Sign on your server.