> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moflay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage credentials

> Configure the Daraja credentials Moflay uses for M-Pesa Express payments in sandbox and production.

Moflay uses saved Daraja credentials to authenticate with Safaricom and send M-Pesa Express payment requests for the selected environment.

## What credentials Moflay uses

Depending on the environment and credential type, you may need:

* Consumer key
* Consumer secret
* Business shortcode
* Passkey
* Account reference
* Short code type, such as till or paybill

## How credentials are used

When your app creates a payment, Moflay selects the credentials for the API key's business and environment. Moflay then authenticates with Daraja and sends the STK push request to Safaricom.

<Info>
  You do not need to build your own Daraja token exchange when you use Moflay.
</Info>

## Sandbox vs production

| Environment | Credential behavior                                                                                            |
| ----------- | -------------------------------------------------------------------------------------------------------------- |
| Sandbox     | You can usually start with assigned test credentials, then optionally add your own Daraja sandbox credentials. |
| Production  | You must provide your own verified live credentials before real payments can be processed.                     |

## Manage credentials in the dashboard

1. Open [Credentials](https://app.moflay.com/credentials).
2. Select `sandbox` or `production`.
3. Enter or review the credential fields.
4. Save the configuration.
5. Run an environment-specific payment test.

## Verify the result

Your credential setup is working when:

* Sandbox payments work with a `mof_test_` API key.
* Production payments work with a `mof_live_` API key after live credentials are verified.
* The dashboard shows the payment in the same environment as the API key.

## Security

Moflay encrypts sensitive Daraja credential fields before storage and scopes credentials to your business and environment.

Read [Credential security](/dashboard/credentials-security) for details on encryption, scoping, and operational precautions.

## Related tasks

* [Set up sandbox credentials](/daraja/setup-sandbox-credentials)
* [Set up production credentials](/daraja/setup-production-credentials)
* [Credential security](/dashboard/credentials-security)
* [Go-live checklist](/go-live/checklist)