
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
mpesa-connect
Advanced tools
A wrapper library for the Daraja Mpesa API
$ pip install mpesa-connect
NOTE: Before you start, make sure to go through the official Daraja Mpesa API documentation
Create an app instance.
from mpesa_connect import App
# Sandbox
app = App.create_sandbox(consumer_key=..., consumer_secret=...)
# Production
app = App.create_production(consumer_key=..., consumer_secret=...)
Generate an authorization token.
from mpesa_connect import Authorization
auth = Authorization(app)
result = auth.generate_token()
access_token = result.access_token
You can attach this token to the service instance or include it as an argument to the api methods calls
STK Push
from mpesa_connect import STKPush
stk = STKPush(app, access_token=access_token)
result = stk.process_request(
business_short_code=...,
phone_number=...,
amount=...,
call_back_url=...,
account_reference=...,
transaction_desc=...,
password=...,
timestamp=...,
# access_token=access_token
)
Query
result = stk.query(
business_short_code=...,
checkout_request_id=...,
password=...,
)
You can use the generate_password helper to create a password
from mpesa_connect.utils import generate_password
password = generate_password(
business_short_code=....,
pass_key=...,
timestamp=...,
)
Alternatively, you can include the pass_key argument in place of password to auto generate the password
Register URL
from mpesa_connect import C2B
from mpesa_connect.enums import ResponseType, TransactionType
c2b = C2B(app, access_token=access_token)
result = c2b.register_url(
short_code=...,
validation_url=...,
confirmation_url=...,
response_type=ResponseType.COMPLETED,
)
Simulate
result = c2b.simulate(
short_code=...,
command_id=TransactionType.CUSTOMER_PAY_BILL_ONLINE,
amount=...,
msisdn=...,
bill_ref_number=...,
)
from mpesa_connect import B2C
from mpesa_connect.enums import TransactionType
b2c = B2C(app, access_token=access_token)
result = b2c.payment_request(
initiator_name=...,
security_credential=...,
amount=...,
command_id=TransactionType.BUSINESS_PAYMENT,
party_a=...,
party_b=...,
queue_time_out_url=...,
result_url=...,
remarks=...,
occassion=...,
)
from mpesa_connect import AccountBalance
from mpesa_connect.enums import TransactionType, IdentifierType
ab = AccountBalance(app, access_token=access_token)
result = ab.query(
initiator=...,
security_credential=...,
command_id=TransactionType.ACCOUNT_BALANCE,
identifier_type=IdentifierType.ORGANIZATION_SHORT_CODE,
party_a=...,
queue_time_out_url=...,
result_url=...,
remarks=...,
)
from mpesa_connect import TransactionStatus
from mpesa_connect.enums import TransactionType, IdentifierType
ts = TransactionStatus(app, access_token=access_token)
result = ts.query(
initiator=...,
security_credential=...,
transaction_id=...,
command_id=TransactionType.TRANSACTION_STATUS_QUERY,
identifier_type=IdentifierType.ORGANIZATION_SHORT_CODE,
party_a=...,
queue_time_out_url=...,
result_url=...,
remarks=...,
occassion=...,
)
All API methods return a result object with a response property which is a requests.Response object, plus various properties corresponding to the json body of the response
Install dependencies
$ poetry install
Create .env file from .env.example then edit it to add your app credentials and test parameters
$ cp .env.example .env
Run tests
$ poetry run pytest
FAQs
A wrapper library for the Daraja Mpesa API
We found that mpesa-connect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.