v5.0.0 — full Daraja coverage, typed responses

A full rewrite. See the
upgrade guide.

Changed — breaking

• Requires PHP 8.3 and Laravel 12 or 13, up from PHP 7.3 and Laravel 8.
  Laravel 10 and 11 are excluded:
  both are past end of life and carry unpatched advisories, so Composer refuses
  to install them without disabling its security audit.
• The facade is now Daraja. MpesaApi and the Requests\* classes are
  replaced by the Apis\* namespace, resolved through the container.
• Responses are readonly objects rather than stdClass. The decoded array
  remains available on ->raw.
• ApiRequestException replaces MpesaApiRequestException, and now carries
  errorCode, requestId, status and payload.
• Configuration keys reorganised — stk_push.* to stk.*, c2b_url.* to
  urls.c2b.*, result_url.* to urls.result.*, logs.* to logging.*.
• push() argument order changed: the account reference now precedes the
  description.
• C2B endpoints move to v2 and B2C to v3. C2B v2 masks the MSISDN where
  v1 sent a SHA-256 hash, and B2C v3 requires a unique
  OriginatorConversationID, which the package generates.
• Certificates are per environment. The package now ships both Safaricom
  certificates and picks the one matching mode, where earlier versions bundled
  only the production one and used it for sandbox too.

Added

• Dynamic QR, M-Pesa Ratiba, Bill Manager, Pull Transactions, Lipa na Bonga,
  B2B Express Checkout, B2C Account Top Up and Business to Pochi.
• Opt-in callback routes that dispatch typed events, with parsers that handle
  Daraja's shape changes between success and failure.
• Daraja::validateC2BUsing() for the synchronous C2B validation decision.
• VerifySafaricomIp middleware for restricting callbacks by source address.
• AccountBalances, which unpacks the delimited balance string into named
  accounts.
• daraja:token and daraja:credential commands.
• Enums for command IDs, identifier types, transaction types, QR types and
  standing order frequencies.

Fixed

• STK::push() was uncallable. A required parameter followed an optional
  one, so the signature in v1's own README raised an ArgumentCountError.
• str_limit() was removed in Laravel 6, breaking every STK push.
• daraja:register-urls read the wrong config namespace (mpesaapi.*
  rather than laravel-daraja.*), so it always sent empty URLs.
• An access token was fetched on every instantiation. Tokens are now cached
  for just under their hour-long lifetime.
• TLS verification was disabled in sandbox mode.
• monolog/monolog ^2 conflicted with Laravel 11+. The package now logs
  through Laravel's logger.
• Configuration problems raise a ConfigurationException naming the key or path
  instead of surfacing as a PHP warning promoted to ErrorException.

Install

composer require starnerz/laravel-daraja

Requires PHP 8.3 and Laravel 12 or 13. Applications on Laravel 10 or 11 should stay on ^4.0.

Documentation · Upgrade guide · Full changelog