Gateway Credential Reference
Complete technical reference of parameters, API keys, credentials, and webhooks for all supported Nukta payment gateways.
Managing payment credentials securely
To automate customer transactions, Nukta connects to your payment providers via authenticated API endpoints and secure webhooks. You configure and manage these credentials directly in your dashboard under Settings → Payments.
All sensitive credentials (such as API secret keys and Daraja passkeys) are encrypted at rest and restricted to workspace Owner and Administrator accounts.
Safaricom M-Pesa (with API keys)
Direct integration utilizing your ISP's dedicated Safaricom Daraja developer portal credentials.
| Field | Required | Where to find |
|---|---|---|
| Business Shortcode | Yes | Your 5-to-7 digit Paybill or Buy Goods Till number. |
| Shortcode Type | Yes | Select Paybill or Till / Buy Goods. |
| Consumer Key | Yes | Daraja Portal → My Apps → App Credentials. |
| Consumer Secret | Yes | Daraja Portal → My Apps → App Credentials (secret). |
| Passkey | Yes | Daraja Portal → APIs → M-Pesa Express → Simulate (secret). |
| Confirmation / Callback URL | Dynamic | https://{subdomain}.nukta.one/api/payments/saf/callback |
| Validation URL | Dynamic | https://{subdomain}.nukta.one/api/payments/saf/validation |
Do not paste sandbox credentials (sandbox.safaricom.co.ke) into a live production workspace. Sandbox shortcodes (like 174379) do not process real customer funds.
Paybill (without API keys)
Collects customer payments via automated M-Pesa STK push using Nukta's platform Daraja infrastructure. No Daraja keys or developer onboarding required.
| Field | Required | Notes |
|---|---|---|
| Paybill Number | Yes | Numeric digits only (4–20 characters). Must be an active Safaricom Paybill, not a bank paybill. |
| Account Number | No | Up to 20 alphanumeric characters, hyphens, and slashes. Used only when your Paybill is shared or belongs to a SACCO to allocate money to your business. Blank keeps default reference. |
| Callback URLs | None | Attached dynamically to each payment request; no manual registration required with Safaricom. |
Till Number (without API keys)
Collects customer payments into your Safaricom Buy Goods Till via automated M-Pesa STK push using Nukta's platform Daraja infrastructure.
| Field | Required | Notes |
|---|---|---|
| Till Number | Yes | Maximum 20 characters. Your registered Safaricom Buy Goods Till. No Daraja keys requested. |
| Callback URLs | None | Attached dynamically to each payment request; no manual registration required with Safaricom. |
Bank Account
Collects customer payments via M-Pesa STK push against your bank's official deposit paybill, depositing funds directly into your commercial bank account.
| Field | Required | Notes |
|---|---|---|
| Receiving Bank | Yes | Selected from the supported bank list (searchable by bank name or paybill number). |
| Bank Account Number | Yes | Digits only (maximum 40 characters). Automatically cleared whenever the receiving bank changes. |
| Callback URLs | None | Attached dynamically to each payment request. |
Kopo Kopo
Automates M-Pesa Buy Goods STK push prompts through Kopo Kopo's Incoming Payments API, settling to your linked bank account.
| Field | Required | Notes |
|---|---|---|
| STK Till Number | Yes | Must start with K (maximum 30 characters). Your Kopo Kopo STK till. |
| Client ID | Yes | Obtained from Kopo Kopo Developer Portal → Applications. |
| Client Secret | Yes | Application secret (masked after saving). |
| API Key | Yes | REST API Key from Kopo Kopo API Access settings (masked after saving). |
| Callback URL | Dynamic | https://{subdomain}.nukta.one/api/payments/kopokopo/callback |
Paystack
Hosted checkout window supporting international credit/debit cards, regional mobile money, and direct bank transfers.
| Field | Required | Notes |
|---|---|---|
| Secret Key | Yes | Live secret key starting with sk_live_... (secret, masked after save). |
| Public Key | Yes | Live public key starting with pk_live_.... |
| Callback URL | Dynamic | https://{subdomain}.nukta.one/api/payments/paystack/callback |
Never paste test keys (sk_test_... or pk_test_...) into live workspace settings. Test keys simulate payments without moving real money.
Credential security best practices
- Dedicated Application: Always create a dedicated app named
Nuktain your provider's developer portal. Do not share credentials across multiple separate software systems. - Never Share Secrets: Never send API secret keys, consumer secrets, or passkeys over public chat channels, SMS, or support emails.
- Readiness Test: After entering credentials in Settings → Payments, always click Run Readiness Test to verify that authentication succeeds before saving.