Lesson Summary

In this topic, we will cover the process of authenticating your requests to the Mpesa API using the Consumer Key and Consumer Secret. These two credentials are essential for generating the OAuth 2.0 Access Token, which is required for making authenticated API requests. You will learn how to securely handle these credentials and generate the access token needed to interact with the Mpesa APIs.

Lesson: Understanding and Using Consumer Key and Secret

1. What are Consumer Key and Secret?

   • Consumer Key and Consumer Secret are unique credentials provided by Safaricom when you register your application on the Safaricom Developer Portal. These credentials are used to authenticate your app and authorize access to the Mpesa APIs.
   • Consumer Key: A public identifier used to identify your application during API requests.
   • Consumer Secret: A private key that is paired with the Consumer Key to securely authenticate the app.

2. How to Obtain Consumer Key and Secret

   • To obtain the Consumer Key and Consumer Secret, follow these steps:
     1. Register on the Safaricom Developer Portal: Create an account on the Safaricom Developer Portal.
     2. Create an Application: After logging in, create a new app within the portal, providing the required information (e.g., app name, description).
     3. Get Your Credentials: Once your app is created, you will be able to see your Consumer Key and Consumer Secret. These credentials will be used to authenticate your API requests.

3. Generating the OAuth 2.0 Access Token

   • OAuth 2.0 is the authentication protocol used by Mpesa. To make authenticated requests, you must first generate an Access Token using the Consumer Key and Consumer Secret.

   Steps to generate the Access Token:

   1. Obtain the Access Token URL:
      The Access Token is generated by making a POST request to the following endpoint:

      POST https://api.safaricom.co.ke/oauth/v1/generate?grant_type=client_credentials
      

   2. Request Headers:
      You need to set the authorization header to include your Consumer Key and Consumer Secret.
      • The header format for Basic Authentication will be:

        Authorization: Basic <base64(ConsumerKey:ConsumerSecret)>
        

      3. Send the Request:
         Use Postman or any HTTP client to send the request. You should receive a JSON response containing the Access Token. Example response:

      {
        "access_token": "YourAccessTokenHere",
        "expires_in": 3600
      }
      

   3. Use the Access Token:
      The access token returned will be valid for 1 hour. You must include this token in the header of each API request to authenticate it.

4. Example Request to Generate Access Token (Using Postman)

   • Set the method to POST.
   • Set the URL to https://api.safaricom.co.ke/oauth/v1/generate?grant_type=client_credentials.
   • Add an Authorization header with the value:

     Basic base64(ConsumerKey:ConsumerSecret)
     

   • Send the request and retrieve the Access Token from the response.

5. Best Practices for Storing Consumer Key and Secret

   • Do not hardcode your Consumer Key and Consumer Secret in your code, especially for production environments. Instead, store them securely in environment variables or a secrets management service.
   • Limit access to these credentials, ensuring only authorized team members or services can access them.
   • Regularly rotate your keys to maintain security.

Summary

In this lesson, you learned about the Consumer Key and Consumer Secret, which are essential for authenticating with the Mpesa API. You also explored how to generate the OAuth 2.0 Access Token and how to securely handle and store these credentials to ensure smooth and secure API interactions. This knowledge is vital for accessing the various Mpesa services and performing transactions.