Aurexis Money
The books for M-PESA.Safaricom holds the money.
Aurexis is the control layer over your till: who paid, how much, when, why, and under which reference. One deployment, many businesses. Each tenant uses its own Daraja keys. Onboarding a till does not require a redeploy.
Custodian
Safaricom. We never hold customer balances as a wallet of record for M-PESA cash.
Identity
The gateway strips forged headers and proves the session before financial sees it.
Secrets
Till credentials are sealed with AES-256-GCM. They are write-only. Nothing decrypts them on a GET.
How a payment becomes a record
The console never tells you a customer has paid because an STK prompt was sent. The book moves when Safaricom posts a callback we can match.
1
Prompt
An operator or an API key requests STK Push. The response is SENT — not paid.
2
Customer
Safaricom prompts the phone. Accept or decline happens off this platform.
3
Callback
Daraja posts to /webhooks with the checkout id we issued. Unknown ids change nothing.
4
Ledger
One confirmation. Replays are not double-counted. The statement and the chart use the same engine.
What the console is for
Payments
STK, till activity, quotes, statements. Fee expected is not fee actual. An unknown fee is null, never zero.
Reconciliation
Your book against the M-PESA statement. Balanced and “nothing to compare” are different answers.
Risk
Flags and a blocklist for people to review. The ledger is not auto-corrected in silence.
Keys
Public API for tills and ERPs. A key is shown once. Only a hash is stored.
Security that is visible
Transparency here means the operator can see failures, fees, and mismatches — not that secrets are displayed.
- Identity headers cannot be supplied by a client. The gateway deletes them, then rebuilds them from a verified HS512 JWT.
- Tenant scope is the caller’s own tenant unless the role is super_admin. A URL cannot widen it.
- Charts and PDFs are specified on the server so the screen and the document cannot disagree about a month.
- Document verification is public on purpose: a bank or a landlord can check authenticity without an account. The page does not dump the ledger.