M-Pesa (Safaricom Daraja) · Rate Limits

Mpesa Rate Limits

Daraja enforces throttling at the gateway. OAuth access tokens are short-lived (~3599 seconds) and should be reused within their validity window rather than re-minted per request. Transaction endpoints are subject to per-shortcode transaction-per-second (TPS) ceilings that are provisioned commercially and are not published as fixed public numbers; excessive requests are rejected. Sandbox applies lighter limits suitable for testing only.

Mpesa Rate Limits is the machine-readable rate-limit profile for M-Pesa (Safaricom Daraja) on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 3 rate-limit definitions, measuring seconds, transactions, and requests.

The profile also includes 3 backoff/retry policies defined and response codes documented for throttled and serverBusy.

Tagged areas include Mobile Money, Payments, Kenya, Rate Limiting, and Quotas.

3 Limits Throttle: 429
Mobile MoneyPaymentsKenyaRate LimitingQuotasThrottling

Limits

OAuth Token Lifetime application
seconds
3599
Access token validity; reuse the token until expiry instead of re-generating per call.
Transactions Per Second (TPS) shortcode
transactions
see provider onboarding
Per-shortcode ceiling provisioned commercially; not a fixed public value.
Sandbox Throttle application
requests
see provider documentation
Lighter limits for the sandbox test environment.

Policies

Token Reuse
Cache and reuse the OAuth access token within its ~3599s lifetime; do not mint a new token per request.
Backoff Strategy
Implement exponential backoff with jitter on 429/500 responses and treat asynchronous ResultURL callbacks as the source of truth for final status.
Idempotency
Use unique OriginatorConversationID / AccountReference values to avoid duplicate funds movement on retries.

Sources