Authorization
Generate the OAuth access token every other Daraja call requires.
Safaricom documents this as the API that must be called before any other API on the platform, since every other endpoint requires the access token it returns.
Endpoint
GET https://sandbox.safaricom.co.ke/oauth/v1/generate?grant_type=client_credentialsOverview
- OAuth 2.0, client credentials grant.
- Tokens expire after 3600 seconds (1 hour).
- The Daraja Simulator generates and refreshes tokens automatically when you pick an app to simulate with, so you only need to implement this yourself outside the simulator.
Prerequisites
- A Daraja account on the Safaricom Developer Portal.
- A sandbox app created on the portal, which supplies a Consumer Key and Consumer Secret.
Get API Credentials
Retrieve your Consumer Key and Consumer Secret from My Apps on the portal.
Keep credentials strictly secret
Never expose or commit your Consumer Key and Consumer Secret in client-side code, frontend bundles, or public repositories. Treat them as confidential server-side secrets at all times.
Send Basic Auth Request
Send a GET request to the endpoint above using HTTP Basic Authentication, with the Consumer Key as the username and the Consumer Secret as the password.
Receive Access Token
Safaricom validates the credentials and returns an access token.
Attach Bearer Token
Use that token as a Bearer token on every subsequent API call, until it expires.
Request
Documented as an "AUTHORIZATION (Basic Auth)" request with username and password, sent as the Basic Auth header:
Authorization: Basic Q2RtTmJkdDBpQk4xb3FEZkthc200ZGFiZHBLbXRhTm46RExLRzdQQnVuNzIwR1ppbQ==Prop
Type
Response
{
"access_token": "c9SQxWWhmdVRlyh0zh8gZDTkubVF",
"expires_in": 3599
}| Field | Description | Sample value |
|---|---|---|
access_token | The Bearer token to use on subsequent calls. | c9SQxWWhmdVRlyh0zh8gZDTkubVF |
expires_in | Seconds until the token expires. | 3599 |
Error responses
| Error code | Meaning | Cause | Fix |
|---|---|---|---|
400.008.02 | Invalid grant type | Wrong value in grant_type | Use client_credentials. |
400.008.01 | Invalid authentication type | Authorization header isn't Basic | Use Basic Auth. |
Testing
Use the Authorization API Simulator on the portal: pick one of your apps, let it invoke the request, and check the response. Outside the simulator, generate the token yourself against the sandbox endpoint above and reuse it (before it expires) across whichever product you're testing.
Tokens expire after 3600 seconds. Generate a new one.
Confirm grant_type is exactly client_credentials.
Yes, but Safaricom's documentation notes that each new request invalidates the previous token.
Introduction
What this section is, how it was put together, and what to set up before calling any Daraja endpoint.
Organization Portal & Go Live
Creating operators, assigning API roles, and generating security credentials on the M-PESA Organization Portal. Referenced by nearly every collection and disbursement API.