The verdict in three sentences
A clean Paystack checkout codes in two endpoints plus one webhook: initialize the transaction, open the JavaScript popup (or redirect), then verify the payment server-side. The source of truth is always the signed webhook, never the browser return, which can be lost or forged. By choosing the hosted popup over a low-level API, you avoid PCI scope and ship in days, not weeks.
Hosted popup or direct API: the structural decision
The first trade-off is whether you let Paystack host the payment surface or you collect through a low-level API. For 95 % of stores in Lagos, the hosted popup is the right call: smaller attack surface, less maintenance, faster launch.
| Criterion | Hosted popup | Direct API |
|---|---|---|
| Integration time | 2 to 4 days | 2 to 4 weeks |
| PCI-DSS scope | Handled by Paystack | On you |
| UI customization | Limited (logo, colors) | Full |
| Endpoints to code | 2 (initialize + verify) | 6 and more |
| Annual maintenance cost | Low | High |
| Recommended for | SMEs, MVPs | High-volume platforms |
For a store that is starting out, every week of development saved beats a customization the buyer will not remember.
Endpoints, statuses and delays in 2026
The Paystack flow relies on a transaction initialized server-side, a reference returned, a popup or redirect, then a final status. Here are the parameters to lock down before coding.
| Element | Recommended 2026 value | Role |
|---|---|---|
| Initialize | POST /transaction/initialize | Returns access_code + reference |
| Verify | GET /transaction/verify/:ref | Confirms success/failed |
| Session timeout | 15 minutes | Expires abandoned carts |
| Webhook signature | HMAC-SHA512 | Authenticates the notification |
| Possible statuses | pending, success, failed | Payment lifecycle |
| Clock tolerance | 300 seconds | Anti-replay on timestamp |
| Currency | NGN (kobo) | Amount in minor units |
Golden rule: only validate the order upon receiving the success webhook whose signature you have verified. The browser return only serves to show a waiting message.
Cost comparison with Wave (Dakar)
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
If you also serve francophone West Africa, Wave offers a twin logic: create session then verify, with a redirect and QR. Fees differ noticeably.
| Provider | Integration model | 2026 transaction fee | Fee cap |
|---|---|---|---|
| Paystack (Nigeria) | initialize + verify + popup | 1.5 % + 100 NGN | 2,000 NGN per transaction |
| Wave (Senegal) | Hosted checkout + webhook | ballpark 1 % | Per merchant contract |
| Orange Money Web | Redirect OAuth + notify | ballpark 1.5 % | Per contract |
Mini case study
Chidi runs a cosmetics store in Lagos, collecting 3,000,000 NGN per month across 250 orders (average basket 12,000 NGN). At 1.5 % + 100 NGN capped at 2,000 NGN, monthly fees land near 45,000 NGN. Moving from manual transfer to the hosted Paystack popup, his cart abandonment drops from 34 % to 19 %, roughly forty recovered orders: about 480,000 NGN of additional revenue per month for a near-identical fee cost.
FAQ
Do I need PCI-DSS compliance to integrate Paystack? No, with the hosted popup Paystack hosts the input and carries the compliance. You never handle card data, only a reference and access code.
What timeout should a payment session use? 15 minutes is the right balance in 2026: enough to enter a code, short enough to release stock from an abandoned cart. Longer, and you risk phantom sales.
Why not trust the browser return? Because it can be lost if the buyer closes the tab, or forged. Only the signed HMAC-SHA512 webhook, verified server-side, should trigger order validation.
How long to integrate a clean Paystack checkout? Plan 2 to 4 days of development for a hosted popup with the 2 endpoints and the webhook, versus 2 to 4 weeks for a direct API with compliance on you.
Can Paystack and Wave coexist? Yes, through a single server-side abstraction layer: each provider implements the same checkout/webhook/status interface, and you route by the buyer's country.
Let's talk about your project. We integrate a hosted Paystack checkout, tested and secured, on your Lagos store in under a week. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
