> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moflay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up production credentials

> Obtain live Daraja credentials from Safaricom, then connect them to Moflay for production M-Pesa Express payments.

Production credentials link your **live** Safaricom Daraja app to Moflay so STK Push requests use your real till or paybill.

## Prerequisites

* A Moflay organization with access to the **production** environment
* A valid **till or paybill** from your M-Pesa business onboarding (live shortcode)
* Access to the [Safaricom Daraja developer portal](https://developer.safaricom.co.ke/)

## Part A: Obtain values from Safaricom

Safaricom’s portal labels and steps change over time. Use **[developer.safaricom.co.ke](https://developer.safaricom.co.ke/)** and the **official API documentation** inside the portal as the source of truth—not third-party tutorials.

At a high level, you will:

1. **Register or sign in** to the Daraja developer portal (often a company account for production use).
2. **Create or open an app** tied to your integration and **enable the Lipa na M-Pesa Online / STK Push** (or equivalent) product for that app.
3. Complete any **go-live** or **production onboarding** steps the portal requires for live traffic.
4. Collect the following for your **live** app (names may appear slightly differently in the portal):

| Value                  | Purpose                                                                                          |
| ---------------------- | ------------------------------------------------------------------------------------------------ |
| **Consumer key**       | OAuth2 client id for Daraja                                                                      |
| **Consumer secret**    | OAuth2 client secret; with the key, used to obtain a bearer access token                         |
| **Business shortcode** | Your live till or paybill number used in API requests                                            |
| **Passkey**            | Used with the shortcode (and timestamp) to build the STK password field                          |
| **Shortcode type**     | Whether the shortcode is a **till** or **paybill** (or the type Moflay expects in the dashboard) |

**Sandbox vs production:** Test apps and keys use Safaricom’s sandbox base URL; production uses the live host. Moflay stores your credentials per environment—you paste **production** values only when production is selected in the dashboard.

If anything in the portal disagrees with this page, **follow the portal.**

## Part B: Add credentials to Moflay

<Steps>
  <Step title="Open the production environment">
    Go to [Credentials](https://app.moflay.com/credentials) in the Moflay dashboard and switch from sandbox to **production**.
  </Step>

  <Step title="Enter the live Daraja values">
    Paste your consumer key, consumer secret, shortcode, and passkey. Choose the correct **short code type** (for example till or paybill).
  </Step>

  <Step title="Save the configuration">
    Save so Moflay encrypts and stores the credentials for your business in production.
  </Step>

  <Step title="Create a production API key">
    Generate a `mof_live_` API key for the service that will call Moflay in production.
  </Step>
</Steps>

## Why Moflay does not ask for a Callback URL here

Moflay sets Safaricom’s STK **`CallBackURL`** automatically when initiating each payment. Your server should listen for **Moflay webhooks**, not raw Daraja callbacks. See [Daraja callbacks](/daraja/handling-callbacks).

## Important behavior

* Moflay exchanges OAuth tokens with Daraja using the stored key and secret—you do not implement token requests yourself.
* Your backend should consume Moflay webhooks for lifecycle events (for example `payment.completed`). See [Webhook events](/webhooks/events).

## Verify the result

Your production setup is complete when:

* Credentials save successfully in the production environment
* Credentials show as active and valid in the dashboard
* A `mof_live_` API key authenticates successfully
* A controlled live payment test completes end to end

## Troubleshooting

* **Payment request fails immediately:** Recheck consumer key, consumer secret, shortcode, passkey, and shortcode type. See [Credential security](/dashboard/credentials-security) if you suspect leakage or rotation issues.
* **Sandbox works but production does not:** Confirm you switched both the **credentials** page and your **API key** to production.
* **Your backend never sees final status:** Configure Moflay webhooks and verify [signature verification](/webhooks/signature-verification). See [Daraja callbacks](/daraja/handling-callbacks) for how status is determined.

## Related pages

* [Manage dashboard credentials](/dashboard/credentials)
* [Set up sandbox credentials](/daraja/setup-sandbox-credentials)
* [Daraja callbacks](/daraja/handling-callbacks)
* [Credential security](/dashboard/credentials-security)
* [Go-live checklist](/go-live/checklist)
* [Webhook overview](/webhooks/overview)
* [Payment statuses & outcomes](/payments/transaction-statuses)