One request sends the prompt. Pay confirms the result with Safaricom, then posts a signed webhook.
Tokens, passwords and certificates
On bare Daraja you request OAuth tokens, build a base64 password from shortcode, passkey and timestamp, and RSA-encrypt an initiator password with Safaricom's certificate for B2C and reversals. Pay does each of these for every request.
Callbacks you can believe
A Daraja callback can be late, duplicated, out of order or missing. Pay authenticates it, confirms each STK push result with Safaricom, settles once and polls for anything that never arrived.
Retries that do not double-charge
Daraja has no idempotency keys. Pay adds them to every money-moving request and resolves timeouts by asking Safaricom, never by sending again.
More than M-Pesa
Airtel Money and card collections, and payouts to Airtel Money and banks, use the same API, webhooks and ledger, through SasaPay, KCB Buni and Paystack.