Callback URL Validation

Every endpoint that accepts a webhook URL mpesaExpress.push()'s callBackURL, c2b.registerUrl()'s confirmationUrl/validationUrl, and b2cTopUp.topUp()'s queueTimeOutURL/resultURL runs the same validateCallbackUrl() check before the request is sent.

What gets checked, in orderCopy Anchor Link

1. Presence must be a non-empty string
2. Valid URL must parse with the URL constructor and use http: or https:
3. HTTPS in production if environment: 'production', http:// URLs are rejected outright
4. No banned keywords the hostname+path can't contain mpesa, safaricom, exec, or sql (case-insensitive). These are local SDK validation rules.
5. No configured tunneling hosts ngrok.io, ngrok-free.app, ngrok.app, mockbin.org, requestbin.com, and requestbin.net (and their subdomains) are rejected by the SDK.

// Throws INVALID_CALLBACK_URL: "callBackURL contains a disallowed keyword
// (\"mpesa\")."
await daraja.stkPush({
  // ...
  callBackURL: "https://example.com/mpesa-callback",
});

Which fields this applies toCopy Anchor Link

There is currently no config flag to relax these checks. Rename a route or use a different hostname when a legitimate URL matches a blocked value.