One authenticated POST asks the customer to pay. A signed webhook tells you when it is done. No SDK, no OAuth dance, no Paybill integration forms.
curl -X POST https://pay.vunaonline.co.ke/api/v1/payments \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"amount":500,"phone":"2547XXXXXXXX","reference":"ORDER-1042"}'
The customer instantly receives the M-Pesa prompt. You get a payment id back that you can use with the status endpoint.
Poll GET /api/v1/payments/<id> if that suits your stack, or subscribe with a webhook URL and receive a signed POST the moment the payment completes. Every webhook carries an HMAC signature header so you can verify it came from us and reject replays.
Cancelled prompts, timeouts and failed payments fire webhooks too, with the reason. That means your checkout can release stock, stop polling and tell the customer the truth instead of hanging.
Amounts are whole Kenyan shillings, KES 1 to 1,000,000. Start with a KES 1 payment to prove your integration end to end, then go live. Rate limits protect your account from runaway loops.