STK Push

Lipa Na M-Pesa Online

C2B

Automated Reconciliation

B2C

Automated Refunds

Dashboard

Full Management

Download Now

v3.1.0 - Latest Release

Download Module

FlexPay Gateway Module

modules/gateways/flexpay.php


  • STK Push (Lipa Na M-Pesa Online) checkout widget with live polling
  • Fully automated C2B (Paybill) payment reconciliation
  • B2C refunds (triggered by WHMCS native Refund button)
  • Manual-paybill fallback shown to customers
  • Customer self-verification box on invoice page

FlexPay Dashboard Addon

modules/addons/flexpay_dashboard/


  • Overview: live stats, account balance, unmatched-payment alerts
  • Transactions: full searchable/filterable ledger
  • Refunds: tracks every B2C disbursement
  • Reconciliation: one-click matching of unmatched C2B payments
  • Tools: Transaction Status, Reversal, force C2B re-registration
  • API Log: full audit trail of every Daraja API call

Admin Homepage Widget

WHMCS Admin Dashboard


  • Live 7-day stats card on WHMCS admin dashboard
  • Total transactions, volume, and success rate
  • Quick link into full Dashboard
  • Automatic activation with addon
  • No further setup needed
Auto-registers and auto-re-registers

Every time an invoice page loads, the gateway checks whether your shortcode + domain + sandbox/live flag has changed since the last successful registration. The instant something changes, it silently re-registers with Daraja. No manual step, ever, even after a domain migration.

Tolerates real customer typos

When a customer pays via the M-Pesa menu and fat-fingers the account reference — `INV42` instead of `INV-42`, or just `42`, or `0000042` — FlexPay's reference parser extracts the invoice number anyway and applies the payment automatically. Only genuinely unparseable references land in the Reconciliation queue.

Strict or lenient, your choice

Lenient mode (default) never blocks a real payment over a formatting quirk — it reconciles in the dashboard instead. Strict mode rejects unrecognised references immediately, before Safaricom finalizes the payment.

Intelligent Till vs Paybill C2B Matching
Paybill

Matches by parsing invoice number from reference

Till

Matches by exact amount against open invoices


Safaricom's own C2B payload leaves BillRefNumber empty for Till payments — there's never a reference to match against. FlexPay handles this intelligently.
STK Push

Lipa Na M-Pesa Online checkout widget with live polling

C2B Reconciliation

Fully automated Paybill payment reconciliation

B2C Refunds

Triggered by WHMCS native Refund button

Transaction Reversal

Full reversal support via Daraja API

Transaction Status

Live status queries via Daraja

Account Balance

On-demand balance queries + historical trend

Self-Verification

Customers verify payments instantly

API Log

Full audit trail of every API call

Secure

HMAC-token model proves the request came from a legitimately-rendered page for that specific invoice and amount.

Invoice-Locked

Every lookup is invoice-locked. A receipt belonging to a different invoice is reported as "not found" — never described, confirmed, or used to leak which invoice it actually belongs to.

Rate-Limited

Live Daraja status queries are rate-limited per invoice — enough for genuine retries after a typo, not enough to spam Daraja or enumerate receipts.

Security Model
HMAC-Token Trust
Invoice-Locked Lookup
Rate-Limited per Invoice
Admin Reset Tool Available
Reuses Idempotent Settlement Logic
?route=stk_result STK Push
?route=c2b_check C2B Check
?route=c2b_receipt C2B Receipt
?route=disbursement_result B2C
?route=reversal_result Reversal
?route=balance_result Balance
These are wired up and sent to Daraja automatically — you never need to register or type them yourself.
flexpay_transactions
flexpay_unmatched_payments
flexpay_refunds
flexpay_balance_snapshots
flexpay_api_log
flexpay_settings

A manual fallback schema is included at sql/install.sql but you should never need it — both modules create these tables automatically and idempotently on first load/activation.

WHMCS

7.x or 8.x with Capsule/Eloquent database support (standard since WHMCS 6.0)

PHP

7.4+ (tested against PHP 8.3)

Daraja App

Sandbox or production from developer.safaricom.co.ke

HTTPS

Required for your WHMCS install (Safaricom rejects HTTP callback URLs)

FlexPay v3.1.0

Complete WHMCS M-PESA Module Suite

Latest version with self-verification
  • Gateway Module
  • Dashboard Addon
  • Admin Widget
  • Full Documentation
  • 1 Year Free Updates
Download Now

Version 3.1.0 | Released 2026

Premium Support

Get Premium Support

Priority support and installation assistance.

  • 24/7 Support via WhatsApp
  • Installation Assistance
  • Customization Support
  • Priority Updates
  • 1 Year Premium Support
Contact Support

Get assistance from our expert team

v3.1.0 (Current Release)

Customer self-verification on the invoice page

  • New: customer-facing "Already paid? Verify your payment" box
  • HMAC-token based security model
  • Invoice-locked lookups
  • Rate-limited per invoice
  • Admin "Reset Customer Verify Limit" tool

v3.0.2

Critical settlement fix + intelligent Till/Paybill matching

  • Fixed: settlement function now idempotent
  • Intelligent Till vs Paybill C2B matching
  • New: "Verify a Payment" tool in admin dashboard
  • Live Daraja status query fallback

v3.0.1

Dashboard crash fixes

  • Fixed: widget-activation crash
  • Fixed: undefined-function crash on Balance/Tools actions
  • Overhauled payment page with staged real-time status messages
1
Upload Files

Upload the full contents to your WHMCS root, preserving folder structure exactly (modules/gateways/..., modules/addons/...).

2
Activate Gateway

Setup → Payments → Payment Gateways → Find "M-Pesa via FlexPay (Daraja)" → Activate, then fill in your credentials.

3
Activate Dashboard

Setup → Addon Modules → Find "FlexPay Dashboard (M-Pesa / Daraja)" → Activate → Configure.

4
Done!

C2B URLs register themselves automatically. The admin homepage widget appears automatically once the addon is active.

That's it! No manual steps, no shell commands, no touching the WHMCS API.

WhatsApp

Chat with us instantly on WhatsApp for support and inquiries.

Chat Now

Email

Send us an email for detailed inquiries or support requests.

Email Now

Documentation

Detailed documentation and installation guides available.

View Docs

* FlexPay is developed and maintained by Editoria Web Services. All rights reserved.