Writing
Production notes from real systems — M-Pesa and the Daraja API, Core Web Vitals, and the architecture decisions that hold up under traffic.
- Building SpaceYako: Verification That Takes Itself AwayA property platform for Kenya, where the fraud is specific: stolen photographs and lapsed licences. Three mechanisms, one structural decision, and why the badge has to expire without anyone remembering to remove it.
- M-Pesa Daraja API Integration with Next.js: A Production GuideMost Daraja tutorials stop at a successful STK Push in sandbox. This is the rest of it: token caching, callback verification, idempotent writes and the failure modes that only show up with real money.
- Our Trust Signal Could Be Earned by Clicking a ButtonUsually replies in about two hours. A real number, computed from real data, and an agent could produce it without ever answering anybody. The problem was what we let count as a reply.
- My Rate Limit Was a Speed Bump Wearing a Ceiling's ClothesAn in-memory limiter on serverless does not limit to your number. It limits to your number times however many instances happen to be warm, and it forgets everything when one recycles.
- Fourteen Jobs Ran at 2am and Nobody Would Have KnownThe nightly batch caught every error properly, logged it properly, and recorded it in the response. What it never did was tell a human. One of those jobs carries a statutory deadline.
- We Were Emailing a Country That Lives on WhatsAppSaved-search alerts, price drops, viewing reminders: every notification the product was proudest of went out by email, in a market where almost everyone online is on WhatsApp every single day.
- Every Check Was Green and the Map Was Broken for EverybodyThe tile server answered 200. The PNG was the right size. No console error, no failed request, nothing in Sentry. And every visitor was looking at a map with API KEY REQUIRED painted diagonally across it.
- Reading Now-Playing Off the Stream Instead of Typing It Into a CMSA station site that says what is on air because a person updated it is wrong within the hour. One that reads the broadcast is right by construction. The work is in the metadata, the polling, and what to show when the stream is unreachable.
- A Newsroom Site That Survives the Story That Breaks ItA news site's traffic is not a curve, it is a cliff. And the spike lands on the newest page, the one that was published four minutes ago and whose author is still editing it.
- M-Pesa Refunds and Reversals: Undoing a Payment You Already TookSomebody paid for a listing we had to take down. Giving the money back turned out to be a harder decision than taking it, because M-Pesa offers two ways to do it and they leave completely different records.
- Getting Daraja Approved for Production, and What Breaks on the WayThe code was finished on a Tuesday. We went live nineteen days later. Not one of those days was spent on engineering, and none of it was under my control.
- M-Pesa B2C: Paying People Out Without Losing Track of the MoneyCollecting money with STK Push is the easy half. Sending it back out has stricter credentials, a different failure surface, and no user watching the screen to tell you it went wrong.
- Running M-Pesa STK Push on Serverless Without Losing PaymentsServerless removes the long-lived process that most M-Pesa integrations quietly assume. Token caches, in-memory state, background work after the response: here is what breaks, and what to do instead.
- Testing M-Pesa Callbacks Locally Without ngrokI spent an afternoon restarting a tunnel, editing a URL, sending a shilling, and waiting. Twelve times. Then I worked out that most callback development needs no tunnel at all.
- M-Pesa Reconciliation: Idempotency, Duplicates and the LedgerSafaricom will send the same callback twice. Your job is to make that boring. A practical design for idempotent payment writes, an append-only ledger, and the daily job that catches what both miss.
- Why Your M-Pesa Callback Never ArrivesThe customer paid, Safaricom took the money, and your app never found out. A ranked list of the reasons Daraja callbacks go missing, and how to tell which one is yours.
- Building PixelPress: Client-Side Image Compression with Next.js and SharpA 12MB hero image on a client's homepage sent me down a two-week hole. The result treats smallest acceptable file as a search problem instead of a quality slider you guess at.
- WordPress Core Web Vitals: Fixing LCP, INP and CLS at the SourceA site that took 43 seconds to load taught me that almost everything written about WordPress performance is a list of plugins. The actual work is finding which layer is lying to you.
- What M-Pesa Teaches You About Building Fintech in Emerging MarketsM-Pesa moved money on feature phones and SMS while Silicon Valley was perfecting online banking for people who already had bank accounts. What it got right is not what most people think.