Francisomondi/MPesa_toolkit_api

A scalable Node.js M-Pesa Toolkit API that enables developers to integrate STK Push payments, manage transactions, and secure endpoints using API keys. Built with Express, MongoDB, and designed as a SaaS-ready payment infrastructure for Kenya and beyond. # M-Pesa Toolkit API (Node.js) A powerful and developer-friendly **M-Pesa API toolkit** built with Node.js, Express, and MongoDB. This project enables businesses and developers to integrate **Safaricom M-Pesa STK Push payments**, track transactions, and manage API access securely. --- ## Features * **User Authentication (Register & Login)** * **Secure API Key System (Per User)** * **STK Push Integration (Lipa na M-Pesa Online)** * **Callback Handling (Payment Confirmation)** * **Transaction History Tracking** * **Protected Routes (API Key Middleware)** * **Scalable SaaS Architecture (Multi-user ready)** --- ## Tech Stack * **Backend:** Node.js, Express.js * **Database:** MongoDB (Mongoose) * **Authentication:** JWT + API Keys * **Payments:** Safaricom Daraja API (M-Pesa) * **State Management (Frontend):** Zustand * **HTTP Client:** Axios --- ## Project Structure ``` src/ │ ├── config/ # Database connection ├── controllers/ # Business logic (auth, mpesa) ├── middleware/ # API key auth, error handling ├── models/ # MongoDB schemas ├── routes/ # API routes ├── utils/ # Helpers (API key generator, etc.) └── server.js # App entry point ``` --- ## Installation ### 1. Clone the repo ```bash git clone github.com cd mpesa-toolkit-api ``` ### 2. Install dependencies ```bash npm install ``` ### 3. Setup environment variables Create a `.env` file: ```env PORT=5000 MONGO_URI=your_mongodb_connection_string # Safaricom M-Pesa MPESA_CONSUMER_KEY=your_key MPESA_CONSUMER_SECRET=your_secret MPESA_SHORTCODE=your_shortcode MPESA_PASSKEY=your_passkey MPESA_CALLBACK_URL=your_callback_url ``` --- ## Run the App ```bash npm run dev ``` --- ## Authentication Flow 1. User registers → API key generated automatically 2. API key is stored in database 3. All protected routes require: ```http x-api-key: YOUR_API_KEY ``` --- ## API Endpoints ### Auth ``` POST /api/auth/r …