> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moflay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential security

> Understand how Moflay protects stored Daraja credentials for each business and environment.

Moflay stores Daraja credentials so it can authenticate with Safaricom on your behalf when your app creates an M-Pesa Express payment. Sensitive Daraja credential fields are encrypted before storage and scoped to your business and environment.

## What Moflay protects

Moflay encrypts these Daraja credential fields when you save or update credentials:

* Consumer key
* Consumer secret
* Passkey

Moflay also stores non-secret routing fields such as the business shortcode, account reference, environment, short code type, and credential status.

## How credential encryption works

Moflay uses purpose-scoped encryption for Daraja secrets:

| Control              | Behavior                                                              |
| -------------------- | --------------------------------------------------------------------- |
| Encryption algorithm | AES-256-GCM                                                           |
| Key derivation       | HKDF-SHA256 from the Moflay encryption root key                       |
| Purpose scope        | Daraja credentials use a dedicated encryption purpose                 |
| Ciphertext format    | Versioned encrypted payloads for newly encrypted Daraja secret fields |

AES-GCM provides authenticated encryption, which means encrypted values cannot be decrypted successfully if the ciphertext or authentication tag has been changed.

## Business and environment scoping

Credential records are scoped to:

* Your Moflay business
* The selected environment, `sandbox` or `production`

Moflay allows one M-Pesa Express credential configuration per business per environment. This keeps sandbox testing separate from production payments and prevents a live credential set from being used by a sandbox API key.

## When credentials are decrypted

Moflay decrypts stored Daraja secret fields only when it needs to authenticate with Safaricom for a payment request or credential-dependent operation. Your application continues to call Moflay with an API key; it does not need to perform the Daraja token exchange directly.

## Sandbox assigned credentials

In sandbox, Moflay can use assigned test credentials for fast setup. Custom sandbox credentials and production credentials are stored with the same sensitive-field encryption behavior when you save them.

## What you should still do

* Restrict dashboard access to trusted team members.
* Use separate sandbox and production API keys.
* Rotate credentials if you suspect exposure in Safaricom, Moflay, or your internal systems.
* Keep live Daraja credentials out of source code, chat messages, and ticket attachments.

## Important limits

Moflay encrypts sensitive credential fields before storage, but your team should still treat Daraja credentials as secrets. Do not share them outside trusted operational workflows.

<Info>
  Moflay maintains compatibility with existing credential records during
  migrations. Security documentation should describe the current encryption
  behavior without claiming that every historical row has always used the newest
  ciphertext format.
</Info>

## Related pages

* [Manage credentials](/dashboard/credentials)
* [Set up production credentials](/daraja/setup-production-credentials)
* [Manage API keys](/dashboard/api-keys/introduction)