█

// POST sandbox.safaricom.co.ke/mpesa/stkpush/v1/processrequest
const stkPush = await daraja.stkPush({
  BusinessShortCode: '174379',
  Amount: 1500, PhoneNumber: '2547XXXXXXXX',
  CallBackURL: 'https://api.yoursite.com/mpesa/callback',
  AccountReference: 'ORDER-8842',
});
// CheckoutRequestID → prompt on customer handset

// GET sandbox.safaricom.co.ke/oauth/v1/generate
const auth = Buffer.from(`${consumerKey}:${consumerSecret}`)
  .toString('base64');
const { access_token } = await fetch(oauthUrl, {
  headers: { Authorization: `Basic ${auth}` },
}).then(r => r.json());

// POST .../mpesa/stkpushquery/v1/query
const status = await daraja.stkQuery({
  CheckoutRequestID: 'ws_CO_1912202414020812345678',
  Password: generatePassword(), // shortcode + passkey
  Timestamp: formatTimestamp(),
});
// ResultCode 0 → payment completed on handset

1. 1 OAuth token from Daraja
2. 2 STK Push → customer PIN on phone
3. 3 Safaricom POSTs result to your URL
4. 4 Order marked paid · receipt stored

app.post('/mpesa/callback', async (req, res) => {
  const { ResultCode, MpesaReceiptNumber } = req.body;
  if (ResultCode === 0) await markOrderPaid(req.body);
  res.json({ ResultCode: 0, ResultDesc: 'Accepted' });
});