Infrastructure · Kenya

The mobile money
infrastructure layer.

m0xy is built on Kenya's payment rails from day one — not bolted on. Production Daraja. HMAC-verified callbacks. Consent-first architecture. We are ready for Open Banking before the APIs drop.

Partner with us → See the consumer app
Production
Daraja API
HMAC
Verified callbacks
Idempotent
Every transaction
CBK
Framework aligned

The opportunity

Open Banking is coming to Kenya. Most apps are not ready.
The Central Bank of Kenya is formalizing an Open Banking framework — standardized APIs, consumer consent mechanisms, and data portability across banks and mobile money operators. When those APIs drop, legacy apps will need to rebuild their entire data infrastructure from scratch.

m0xy did not wait. We built the consent layer, the normalized transaction schema, and the secure callback infrastructure before the mandate arrived. When Safaricom and the banks open their pipes, we flip a switch — not rebuild a product.
⚡
Kenya's fintech infrastructure advantage lives on the SIM card, not in web banking portals. m0xy treats M-Pesa, Pochi la Biashara, Buy Goods, and Paybill as first-class citizens — not secondary add-ons.

What we built

Live in production
🔐
HMAC callback verification
Every Daraja callback is verified using HMAC signatures before any transaction state is updated. No unverified writes.
Live in production
🔑
Idempotency on every transaction
Unique transaction IDs on every STK Push prevent duplicate processing — a core requirement of production-grade payment infrastructure.
Live in production
📡
Polling architecture
Backend STK Push Query polling for payment types where callbacks are unreliable — Pochi la Biashara, Buy Goods, Paybill all covered.
Live in production
🗂️
Unified transaction schema
Every payment rail — M-Pesa STK, Pochi, Buy Goods, Paybill — normalized into a single structured schema regardless of source.
Live in production
🔒
Consent-first auth
Firebase Phone OTP authentication gates every data operation. No transaction is written or read without explicit user authorization.
Live in production
📲
M-Pesa native — not bolted on
Built on Safaricom's Daraja API from the first line of code. M-Pesa is the primary rail, not an integration added after the fact.
Live in production
⚙️
Plug-and-play adapter architecture
The backend is structured so data ingestion adapters are decoupled from the core transaction logic. When CBK Open Banking APIs are released, a new adapter plugs in — the schema, the categorization engine, the analytics layer, and the mobile app remain completely unchanged.

Unified transaction schema

Every payment rail normalized to one format. The same schema whether the source is an M-Pesa STK Push, a Pochi la Biashara transfer, or a future Open Banking API feed.

{
  "transaction_id": "TXN_MPE_9842104",
  "provider": "MPESA_STK",
  "timestamp": "2026-06-03T16:15:00Z",
  "amount": 1500.00,
  "currency": "KES",
  "direction": "OUTBOUND",
  "status": "completed",
  "counterparty": {
    "name": "NAIVAS SUPERMARKET",
    "type": "MERCHANT",
    "identifier": "7654321"
  },
  "category": "Shopping",
  "mpesa_receipt": "RGH72KQ9X1",
  "consent_verified": true
}
{
  "transaction_id": "TXN_PCH_1029384",
  "provider": "MPESA_POCHI",
  "timestamp": "2026-06-03T14:22:00Z",
  "amount": 350.00,
  "currency": "KES",
  "direction": "OUTBOUND",
  "status": "completed",
  "counterparty": {
    "name": "MAMA MBOGA - GIKOMBA",
    "type": "POCHI_MERCHANT",
    "identifier": "2547XXXXXXXX"
  },
  "category": "Food & Drinks",
  "mpesa_receipt": "RGH83LR2Y4",
  "consent_verified": true
}
{
  "transaction_id": "TXN_PBL_7730192",
  "provider": "MPESA_PAYBILL",
  "timestamp": "2026-06-02T09:05:00Z",
  "amount": 4200.00,
  "currency": "KES",
  "direction": "OUTBOUND",
  "status": "completed",
  "counterparty": {
    "name": "KENYA POWER",
    "type": "UTILITY",
    "identifier": "522522"
  },
  "category": "Utilities",
  "account_reference": "01234567890",
  "consent_verified": true
}
{
  // Same schema. Different adapter.
  // When CBK Open Banking APIs launch,
  // only the intake pipe changes.

  "transaction_id": "TXN_OBK_4410293",
  "provider": "CBK_OPEN_BANKING_API",
  "timestamp": "2026-XX-XXT00:00:00Z",
  "amount": 8750.00,
  "currency": "KES",
  "direction": "OUTBOUND",
  "status": "completed",
  "counterparty": {
    "name": "EQUITY BANK",
    "type": "BANK_TRANSFER",
    "identifier": "0123456789"
  },
  "category": "Savings",
  "fapi_standard": "KE-OAUTH-2026.1",
  "consent_verified": true
}

CBK Open Banking alignment

✓
Consumer Consent
Phone OTP authentication gates every data read and write. No operation executes without verified user identity.
Live
✓
Standardized API layer
Unified transaction schema across all M-Pesa payment rails. Adapter architecture ready for additional providers.
Live
✓
Transaction initiation
Production STK Push via Daraja API — exactly the transaction initiation model Open Banking formalizes.
Live
✓
Financial inclusion
Expense tracking, budgeting, and merchant payments for the full Kenyan economic spectrum — mobile-first.
Live
✓
Secure callback infrastructure
HMAC verification on every Daraja callback. Idempotency keys prevent duplicate processing.
Live
~
ODPC Data Controller registration
Office of the Data Protection Commissioner registration — in progress. Kenya Data Protection Act (2019) compliant architecture.
In progress
Let's build Kenya's
Open Banking future together.
We are looking for bank, fintech, and regulatory partners who want to co-build the infrastructure layer for Kenya's mobile money ecosystem.
partnerships@m0xy.app →
We respond within 48 hours · Based in Nairobi
Commercial Banks Mobile Money Operators Fintech Startups CBK Regulatory Sandbox Impact Investors