Pesapal

This plugin adds Pesapal payments to your HikaShop store, on the current Pesapal API 3.0. At the end of the checkout your customer is sent to the Pesapal payment page, pays with M-Pesa, Airtel Money or a card, and comes back to the thank you page of your shop. The money goes to your Pesapal merchant account.

• M-Pesa, Airtel Money, Visa, Mastercard and the other methods your Pesapal account offers, on the payment page of Pesapal.
• The customer confirms a mobile money payment on their phone, and 3-D Secure is handled by Pesapal for cards, so your shop never sees a card number.
• The order is charged in its own currency: Kenyan shillings, US dollars, and the other currencies Pesapal accepts for your account, which it converts when your account settles in another one.
• The billing address of the customer is sent along, so they do not type it again on the payment page.

• The order is confirmed by the notification Pesapal sends to your shop, and by the return of the customer, whichever comes first.
• A customer who closes the browser on the payment page, or whose M-Pesa confirmation arrives a few seconds later, still gets the order confirmed.
• The status of a payment is always read from Pesapal, never taken from the notification or from the browser, so a payment cannot be faked.
• A repeated notification confirms the order once and only once.
• The notification address of your shop is registered on your Pesapal account when you save the payment method: there is nothing to set up on the Pesapal side.

• Moving an order to the refunded status, or using the refund button of the order page, sends a refund request to Pesapal, which you approve in your Pesapal dashboard.
• A refund Pesapal refuses leaves the status of the order unchanged, with the reason, so you can see that something went wrong.
• Cancelling an order which was never paid also closes its payment page on Pesapal, so the customer cannot pay it afterwards.
• Every payment, refund request and cancellation is written in the history of the order and in the payment log.

• A sandbox mode runs the whole checkout against the Pesapal sandbox, with the test cards Pesapal publishes, before you take a real payment.
• A debug setting writes every exchange with Pesapal in the payment log of HikaShop, without your consumer secret.

• 1) Open a Pesapal merchant account. Pesapal sends the consumer key and the consumer secret of your account to your email address.
• 2) Download the Pesapal plugin from our website.
• 3) Install it on your Joomla or WordPress website and enable it.
• 4) Go to HikaShop > Payment methods, create a Pesapal payment method, enter the consumer key and the consumer secret, select the environment and save. The notification address of your shop is registered on your Pesapal account at that moment.

• Consumer key and consumer secret: the credentials of your Pesapal account.
• Environment: the Pesapal sandbox while you test, production once you are live.
• Send the billing address: the name and address of the customer, on top of the email address and phone number Pesapal always needs.
• Notification URL: the address Pesapal notifies, and whether it is registered on your account.
• Order statuses: the status of a paid order, of a failed payment and of a refunded order.

Pesapal serves merchants in Kenya, Uganda, Tanzania, Zambia, Zimbabwe, Malawi and Rwanda. The payment methods offered to your customers are the ones your Pesapal account has.

• This plugin is compatible with all the editions of HikaShop
• Requires a Pesapal merchant account on the API 3.0
• Requires the PHP cURL extension
• Requires a website reachable from the internet so Pesapal can notify it of the payments
• Compatible with PHP 7.4 minimum
• Compatible with Joomla and WordPress
• No limit of time
• No limit of use

1.0.0 on the 25th of September 2026

• Initial release with M-Pesa, Airtel Money and card payments on the Pesapal payment page through the Pesapal API 3.0, the confirmation of the order by the notification of Pesapal and by the return of the customer, refund requests and cancellations from the backend, and a sandbox mode.