Download the PHP package leefipay/mpesa without Composer
On this page you can find all versions of the php package leefipay/mpesa. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Informations about the package mpesa
LeefiPay M-Pesa for Laravel
Official Laravel package for integrating applications with the LeefiPay M-Pesa Open API.
API base: https://leefipay.com/api/v1/ · Docs: https://leefipay.com/developers
This package talks to LeefiPay’s public REST API (/api/v1) using Sanctum Bearer tokens. It does not call Safaricom Daraja directly — LeefiPay handles Daraja on your behalf.
Requirements
| Laravel | PHP | Status |
|---|---|---|
| 9.x | 8.1+ | Supported |
| 10.x | 8.1+ | Supported |
| 11.x | 8.2+ | Supported |
| 12.x | 8.2+ | Supported |
| 13.x | 8.3+ | Supported |
Compatibility is enforced by GitHub Actions: package PHPUnit tests (HTTP-faked) plus install into a fresh Laravel application for each matrix entry. Mark rows as Tested only after the Actions workflow is green on main.
Installation
Publish config (optional):
Configuration
Create an API credential in the LeefiPay dashboard (API & Integrations or Developer console). Use the secret token as LEEFIPAY_API_KEY. The public key (lp_pk_…) is not used for request authentication.
LEEFIPAY_ENVIRONMENT is informational (sandbox vs production host is controlled by LEEFIPAY_BASE_URL).
Basic usage
Dependency injection:
STK Push
Required fields (Open API):
| Field | Notes |
|---|---|
amount |
Integer KES ≥ 1 |
phone |
Customer MSISDN |
payment_channel_id |
Till / Paybill channel from LeefiPay |
Optional: customer_name, notes, idempotency_key / Idempotency-Key, account_reference (alias reference), mode (stk|manual|auto).
Transaction status & verify
Payment channels
Connection test
Webhooks (LeefiPay → your app)
Register a webhook URL in the LeefiPay dashboard pointing to:
Set LEEFIPAY_WEBHOOK_SECRET to the whsec_… secret.
The package verifies:
Dispatched events:
LeefiPay\Mpesa\Events\WebhookReceivedLeefiPay\Mpesa\Events\PaymentSuccessful(payment.successful)LeefiPay\Mpesa\Events\PaymentFailed(payment.failed)LeefiPay\Mpesa\Events\InvoicePaid(invoice.paid)
Error handling
Credentials are never included in exception messages or package logs.
Retries
- GET requests may retry on connection failures when
LEEFIPAY_RETRY_ENABLED=true. - Payment POSTs (STK, cash, manual, retry) are never auto-retried. Use
idempotency_keyand retry yourself if needed.
Not currently supported
These are not exposed on the LeefiPay public Open API and are therefore not implemented:
- B2C
- C2B URL registration
- Account balance
- Transaction reversal
- Direct Safaricom Daraja OAuth / passkey usage
Security
- Store tokens and webhook secrets in environment variables only.
- Prefer HTTPS for
LEEFIPAY_BASE_URLand webhook URLs. - Rotate compromised credentials in the LeefiPay dashboard.
See SECURITY.md.
Testing
CI also installs the package into a temporary Laravel app for each supported major version (package discovery, config publish, container + facade resolution). No real LeefiPay / M-Pesa API calls are made.
Versioning
Semantic Versioning. Current development line: 0.1.x. Do not treat this as v1.0.0 until the full Laravel matrix is green in CI.
License
MIT — see LICENSE.
All versions of mpesa with dependencies
guzzlehttp/guzzle Version ^7.5
illuminate/contracts Version ^9.0|^10.0|^11.0|^12.0|^13.0
illuminate/events Version ^9.0|^10.0|^11.0|^12.0|^13.0
illuminate/http Version ^9.0|^10.0|^11.0|^12.0|^13.0
illuminate/routing Version ^9.0|^10.0|^11.0|^12.0|^13.0
illuminate/support Version ^9.0|^10.0|^11.0|^12.0|^13.0