M-Pesa (Safaricom Daraja) · Rate Limits

Mpesa Rate Limits

Daraja enforces throttling at the gateway. OAuth access tokens are short-lived (~3599 seconds) and should be reused within their validity window rather than re-minted per request. Transaction endpoints are subject to per-shortcode transaction-per-second (TPS) ceilings that are provisioned commercially and are not published as fixed public numbers; excessive requests are rejected. Sandbox applies lighter limits suitable for testing only.

Mpesa Rate Limits is the machine-readable rate-limit profile for M-Pesa (Safaricom Daraja) on the APIs.io network, in the API Commons Rate Limits shape.

It captures 3 rate-limit definitions, measuring seconds, transactions, and requests.

An exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 3 backoff/retry policies defined and response codes documented for throttled and serverBusy.

Tagged areas include Mobile Money, Payments, Kenya, Rate Limiting, and Quotas.

3 Limits Exhausted: HTTP 429
Method: generated, dated 2026-07-17.
Written by API Evangelist on 2026-07-17 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
Mobile MoneyPaymentsKenyaRate LimitingQuotasThrottling

Limits

OAuth Token Lifetime application
seconds
3599
Access token validity; reuse the token until expiry instead of re-generating per call.
Transactions Per Second (TPS) shortcode
transactions
see provider onboarding
Per-shortcode ceiling provisioned commercially; not a fixed public value.
Sandbox Throttle application
requests
see provider documentation
Lighter limits for the sandbox test environment.

Policies

Token Reuse
Cache and reuse the OAuth access token within its ~3599s lifetime; do not mint a new token per request.
Backoff Strategy
Implement exponential backoff with jitter on 429/500 responses and treat asynchronous ResultURL callbacks as the source of truth for final status.
Idempotency
Use unique OriginatorConversationID / AccountReference values to avoid duplicate funds movement on retries.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/mpesa-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.