The verdict in three sentences
A poorly hardened payment webhook means 2 to 5 % of notifications lost — orders paid but never confirmed and furious customers. Three protections are non-negotiable: the HMAC signature to authenticate the call, the idempotency key to prevent double-crediting, and an exponential retry queue. As a complement, a fallback poll every 15 minutes recovers the rare permanently lost webhooks.
The three pillars of a reliable webhook
Each pillar answers a specific, measurable risk.
| Pillar | Risk covered | Without the protection |
|---|---|---|
| HMAC signature | Fake webhook / fraud | Credit on forged call |
| Idempotency | Duplicate webhook delivery | Double-credited order |
| Exponential retry | Transient outage | 2-5 % lost webhooks |
| Fallback poll | Permanently lost webhook | Paid order never confirmed |
You don't choose between these; all four stack. The signature guards the entry, idempotency guards processing, retry and polling guard delivery.
The exponential retry queue
When your endpoint returns an error or times out, the operator — or your own queue — retries on a growing interval.
| Attempt | Delay after failure | Cumulative elapsed |
|---|---|---|
| 1 | Immediate | 0 |
| 2 | +1 min | 1 min |
| 3 | +15 min | 16 min |
| 4 | +2 h | ~2 h 16 |
| 5 | +12 h | ~14 h |
Five attempts spread over ~24 h catch nearly all transient outages. Beyond that, reconciliation polling takes over.
Mini case study
Kwame, a developer for an online shop, saw ~3 % of orders stuck in "pending" though they were paid — about 9 orders/day out of 300. Each stuck order generated a ~8-minute support ticket, i.e. 72 min/day lost. After adding idempotency + 24 h retry + polling every 15 min, the stuck-order rate fell to ~0.2 %, under 1 order/day. Savings: ~70 min of support/day and zero double-credits.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How many webhooks are lost without retry?
Between 2 and 5 % depending on your endpoint and operator stability. An exponential retry over 24 h brings this below 0.3 %.
Why is an idempotency key essential?
Because an operator may deliver the same webhook twice. Without an idempotency key you credit the order twice. The key guarantees a transaction ID is processed only once.
How do I verify the HMAC signature?
You recompute the HMAC of the request body with your secret key and compare it to the sent header. If they differ, reject the call: that's your anti-fraud barrier.
Does polling replace webhooks?
No, it's a safety net. Webhooks stay the primary (instant) path; polling every 15 min only catches residual cases lost after the 5 retry attempts.
What processing time should I target for a webhook?
Under 2 to 3 seconds of synchronous processing, otherwise the operator marks the call failed. Acknowledge fast, then process asynchronously.
Let's talk about your project. We'll harden your mobile money webhooks with idempotency, retry and fallback polling. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
