# `Daraja.Express`
[🔗](https://github.com/okothkongo/daraja/blob/v0.1.1/lib/daraja/express.ex#L1)

M-Pesa Express (STK Push) — initiates a payment prompt on a customer's phone.

## Example

    client = Daraja.Client.new()

    Daraja.Express.request(client, %{
      amount: 100,
      phone_number: "254712345678",
      account_reference: "Order-001",
      transaction_desc: "Payment"
    })

The client must carry `business_short_code`, `passkey`, and `callback_url`
(either via options to `Daraja.Client.new/1` or via the `:daraja` application
environment). Calls return `{:error, :invalid_client, missing}` when any of
those fields is missing.

## Security

STK requests encode the passkey into the `Password` field
(`Base64(short_code <> passkey <> timestamp)`). Anyone with a captured request
body can recover the passkey. Never log STK request bodies; ensure TLS-only
transport and redact `Password` in any custom HTTP client logging.

The `Timestamp` field and password must use East Africa Time (EAT, UTC+3),
not the host machine's local timezone or raw UTC.

# `result`

```elixir
@type result() ::
  {:ok, Daraja.Express.Response.Success.t()}
  | {:error, :invalid_request, [atom()]}
  | {:error, :invalid_client, [atom()]}
  | {:error, :auth_failed, Daraja.APIError.t()}
  | {:error, :http_error, Daraja.APIError.t() | term()}
  | {:error, :request_failed,
     Daraja.Express.Response.Error.t() | Daraja.APIError.t()}
```

# `request`

```elixir
@spec request(Daraja.Client.t(), map() | Daraja.Express.Request.t()) :: result()
```

Sends an STK Push (M-Pesa Express) request.

Required params: `amount`, `phone_number`, `account_reference`.
Optional params: `transaction_desc`, `transaction_type`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*