M-PESA portal roles and two-person control

The M-PESA organisation portal roles a Kenyan business needs, from Business Administrator to API initiators, and how to split them so no one acts alone.

By Achekam · 11 October 2026 · 4 min read · For Running a business businesses in Kenya

The M-PESA organisation portal is where a business's M-PESA money is actually controlled. Funds are moved between accounts there, payments are reversed there, and the users that let software talk to M-PESA are created there. Whoever holds the right roles can do all of it.

In a small business it is tempting to give one trusted person every role and move on. That works until the trusted person is on leave, leaves the business, or makes a mistake nobody else sees. Safaricom's own design assumes more than one person, and this article explains the roles it describes and a sensible way to divide them.

Business Administrator and Business Manager

Safaricom says access to the M-PESA Organization Portal needs a Business Administrator role under the short code, and that the short code's settlement option must first be set to Bank through a Head Office application to M-PESABusiness@Safaricom.co.ke.

Getting the first administrator is a formal step. Safaricom says the business sends an official request letter on company letterhead, signed and stamped by its authorised signatories, giving the short code, the organisation name, the administrator's details and a scanned ID, to the same address.

From there, the roles cascade. Safaricom describes the Business Administrator creating a Business Manager on the portal, then an API operator with the access channel set to API and the roles it needs, with the Business Manager setting the API user's password. In short:

• the Business Administrator creates users and unlocks them;
• Business Managers operate the account day to day.

Maker-checker transfers between accounts

Safaricom says moving cash from a C2B account to a B2C account on the portal is a maker-checker transaction: one user with the Business Manager role initiates it, and another approves it.

That rule only works if the business actually has two Business Managers who are different people. A business with one manager cannot make that transfer on the portal, and a business where one person holds two manager logins has defeated the control. Name the maker and the checker, and a stand-in for each, before payday depends on them. Paying staff or customers through M-Pesa B2C explains why the transfer matters.

Reversal and API initiator roles

Software that calls M-PESA on the business's behalf does so through API users, each with specific roles. Safaricom says the API user making reversal requests must hold the Org Reversals Initiator API role, and that a pending API user is activated when a user with the Set Restricted ORG API PASSWORD role sets its password.

Treat API users as system accounts. Create one for each purpose, give it only the roles that purpose needs, and record who set its password and when. A person who can both create an API user with reversal rights and set its password can, in effect, reverse payments alone.

Reversals done by hand on the portal are covered in refunding M-Pesa payments by hand.

Locked credentials and who unlocks them

Safaricom says multiple invalid credential attempts lock the API user's password, with the message "The security credential is locked", and that the Business Administrator must unlock it.

Two lessons follow. An integration that keeps retrying with a wrong credential will lock itself out, so fix the cause before asking for an unlock. And the administrator must be reachable: if the only administrator is travelling, a locked credential can stop collections or payouts until they return. A second administrator, appointed through the same letter process, removes that single point of failure.

Changing where notifications go

The addresses that receive M-PESA notifications are guarded too. Production URL registration is a one-time step per short code at Safaricom, and changing it needs two operators in the M-PESA org portal. Changing your C2B URLs walks through that.

Going live also involves keys. To take M-Pesa in production through Achekam, a business completes Safaricom's Go-Live for its short code and enters its own production short code, passkey and Daraja keys; Safaricom e-mails the production passkey after Go-Live. Keep that e-mail somewhere only the administrators can reach.

Two-person steps in Achekam

The same principle runs through Achekam's own controls:

• Only a workspace administrator can save payment gateway credentials under Payment Gateways & Checkout; other users can view the settings but not change them.
• At the till, discounts above the business's limit, refunds, voids and cash paid out need a supervisor or manager. The cashier is the signed-in user; there is no cashier PIN.
• In payroll, an approved change to an employee's bank account still needs a second person to verify it.
• A tax payment recorded in Achekam needs a second person to confirm it.

None of these replace the portal's controls. They mirror them, so that the books and the M-PESA account are guarded the same way.

A roles matrix for your business

Review the matrix whenever someone joins, changes job or leaves, and remove portal access on the day a person goes.

Safaricom's Daraja FAQs answer common questions about short codes, test credentials, re-registering URLs and the pass key needed to go live.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.