M-PESA QR codes

How do I get an M-PESA QR code?

You get an M-PESA QR code from Safaricom, not from a QR generator. Register for Lipa na M-PESA — a Buy Goods till, a Paybill, or Pochi la Biashara — and the scan-to-pay code is issued against that merchant account through the M-PESA Business app, or generated per transaction through the Daraja Dynamic QR API. Your customer scans it and enters their PIN.

What is actually inside an M-PESA QR code?

An M-PESA QR code contains payment instructions, not a web address. Encoded in it are the merchant identifier — your till, paybill or Pochi number — and, on a dynamic code, the exact amount. The M-PESA app reads those fields and pre-fills the payment screen, which is why the customer only has to confirm and enter a PIN.

That is the whole reason you cannot make one in a design tool. A QR code is just a container; what matters is whether the app opening it recognises the format and trusts the merchant behind it. A camera app pointed at a hand-made “M-PESA code” will decode some text and do nothing with it — which, at a counter with a queue behind it, is worse than having printed nothing.

Till, paybill, or Pochi la Biashara?

Pick this before you print anything, because the number is what gets encoded.

• Buy Goods (till number) — over-the-counter sales where the amount is whatever is in the basket. Shops, cafés, salons, matatu SACCOs. The customer is not asked for a reference.
• Paybill — takes an account number as well as an amount, so the payment arrives attached to something. Rent, school fees, invoices, subscriptions, member dues. If you have ever reconciled a bank statement by hand, this is the one that saves the afternoon.
• Pochi la Biashara — for small and informal traders: it keeps business money in a separate balance on the Safaricom line you already carry, and shows customers a business name rather than a personal one. Registration is on *334#.

Static and dynamic M-PESA codes are not the same argument

In the payments world a dynamic code means the amount is baked in for one transaction — generated per sale through the Daraja Dynamic QR API, which needs a registered app with a consumer key and secret. A static merchant code identifies you and leaves the customer to type the amount.

That is a different distinction from the one ondynamic versus static QR codes, where dynamic means the destination can be changed after printing. Same two words, two unrelated meanings. People conflate them constantly and end up printing the wrong thing, so it is worth being blunt: a payment code has no destination to re-point, and a link code has no amount to fill in.

Tap to Pay arrived in August 2026, and QR did not go away

Safaricom switched on Tap to Pay in the M-PESA Business App in August 2026 — NFC, phone against terminal, no scanning. It is faster where it works, and QR remains the fallback beside it.

For anyone printing this year, the practical read is that the fallback is the part with universal reach. NFC needs supported hardware on both sides of the transaction. A printed code needs a camera and an app, which is the phone almost everyone already has, and it keeps working on a poster after the counter hardware has been replaced twice.

The code beside the payment code

The payment code takes money and nothing else. Everything a customer wants to see beforethey pay — the menu, the price list, the catalogue, the delivery form, the loyalty sign-up — lives on a web page, and that is the second code on the poster. It is the one that changes weekly, which is exactly why it should be re-pointable without a reprint.

This is where a dynamic link code earns its place. Prices move, a menu goes seasonal, a promotion ends. If the second code isstatic, every one of those is a reprint. If it points at a short link you control, it is an edit — and the printed material on two hundred tables never has to be touched.

Printing them as a pair

1. Label both, in words. “Scan to pay” and “Scan for the menu”. An unlabelled pair of codes is a coin toss.
2. Separate them physically. Codes sitting side by side get scanned as one blurry target. Put a rule or a gap between them.
3. Size for the real distance. A code on a table tent is read from arm’s length; one on a wall behind a counter is read from three metres. Check the width against the distance.
4. Keep the quiet zone. Both codes need a clear margin four modules wide. It is the first thing a layout crops.
5. Test the printed proof on an old Android handset in bad light, not on the designer’s new iPhone.

What you can measure, and what you cannot

Safaricom’s side tells you about payments — you see the money. The QR itself does not tell you how many people looked at your poster and did not pay. The link code beside it does: scans, device, county, and the time of day people actually engage, which for most Kenyan businesses is not the hour they assume. Seewhat a scan can and cannot tell you — including why “who scanned it” is not on that list.