I built a tiny web page that lets a shop accept payment through M-Pesa after a buyer clicks a button. I got stuck on checking that the request really comes from M-Pesa, I need to verify the signature they send. The trick is to use the secret key they give and compare the hash, but I’m not sure how to set that up yet.
Hey, nice start! For the signature check, Safaricom sends a Base64-encoded SHA256 hash with their request - you generate the same hash on your side using your webhook secret and compare the two. Quick way to test: copy one of their example payloads from the docs, run it through a simple PHP or Python script that does the hash match, and see if it clicks.
Nice one, that verification step trips up almost everyone starting out. One simple way to see it click: take one of Safaricom's sample payloads, compute the hash with your secret in a tiny script, and compare it to theirs before you even touch the webhook code. Which language are you building the backend in, PHP or Python?
Nice one getting this far - that verification step always catches people. If you're just trying to see it work, try copying one of Safaricom's example payloads into a free online tool like Postman and run the hash comparison there before writing any code. Which language are you most comfortable with? That'll help narrow down the exact steps.
Nice, this is the step that makes it feel real when it finally clicks. Since you're still setting it up, grab one of Safaricom's sample payloads from the developer portal, then in your script just hash the raw body with your secret and compare it to the signature they send. If you share what language you're using, PHP or Python, we can give you the exact lines to try.
That verification step is the one that catches almost everyone the first time. If you're using Python, the `hmac` and `hashlib` libraries do the heavy lifting - just feed them your secret and the raw request body, then compare the base64 result to the header Safaricom sends. Want to paste a snippet of what you have so far? We can walk through the exact lines together.
That verification step is a classic headache, I remember staring at the Safaricom docs for ages when I first tried it. If you haven't already, grab one of their sample payloads from the developer portal and test the hash match in a tiny standalone script first - keeps things simple before you wire it into your actual endpoint. What language is your backend in?