PesaCastQuestions people ask first.
- Is it safe?
It does less than you might fear. It receives M-PESA messages and forwards them where you tell it. It cannot send money, cannot send SMS and never asks for your PIN. Read the security page for the details, including the parts that are not yet independently reviewed.
- How is this different from an SMS forwarding app?
It is an SMS forwarder that only does M-PESA. A general forwarder passes on every text it sees, as raw text. PesaCast keeps only messages from MPESA, drops the rest, and turns each payment into an amount, a name, a reference and a balance. It then shows it on your computer or posts it to your server, signed, with a queue that retries until your server answers. The price of being narrow: it understands nothing but M-PESA.
- Does it read all my text messages?
Android’s SMS permission is all or nothing, so the app is able to receive every incoming text. The code looks at the sender, keeps only messages from MPESA, and drops the rest without storing or logging them. You do not have to take our word for it: the receiver is about fifty lines.
- Why is it not on the Play Store?
Google Play restricts which apps may read SMS to a short list of uses, and mirroring payments is not an obvious fit. So PesaCast is installed from a file. That is why the setup checks the file’s checksum, and why Play Protect may ask about it.
- Can I trust a payment that PesaCast shows?
Trust it as a notification, not as a receipt. An SMS can be spoofed or arrive late. For anything that releases goods or credits an account, confirm through Safaricom’s Daraja callbacks.
- Do I need a computer?
No. The webhook sends payments straight from the phone to your server. The computer is for the desktop view, notifications and Excel export.
- What happens if the phone is off or has no signal?
No message arrives, so nothing is forwarded. The mobile network usually delivers the SMS once the phone is back, and the phone forwards it then. If the phone has the message but your server is down, PesaCast keeps up to 500 transactions for up to seven days and retries until your server accepts them.
- Does it work with two phones, or two shops?
Each phone sends its own payments. A webhook receiver can tell them apart by the device identifier in every request. The desktop app talks to one phone at a time, so use the webhook if you need several.
- What does it cost?
Nothing. It is free software under the MIT licence.
- Which versions have which features?
The setup script, setup checklist and webhook arrived in version 0.9.0. Version 0.8 and older do not have them. Update the phone and the desktop together. The releases page lists what each version contains.
- Something is wrong. Where do I say so?
Open an issue. For a security problem, do not post it publicly; follow the steps on the security page.