Making Paystack payment webhooks reliable in production (2026)

The verdict in three sentences

On a store collecting via Wave or Paystack, 3 to 5 % of orders get stuck "pending" because a webhook was lost or processed twice. The robust solution is not the webhook alone: it is webhook + reconciliation polling, with a verified HMAC signature, an idempotency key and an endpoint that replies in under 200 ms. Without that safety net, you leave money collected with no validated order — and customers who paid and received nothing.

The classic problems and their fixes

A webhook is just an HTTP call from the provider to your server. Anything that can break an HTTP call can break a webhook: timeout, redeploy, double send, reversed order. The customer-side symptom is always the same: a ghost order, paid but never confirmed.

*2026 best practices valid for Wave, Paystack, Flutterwave and Orange Money.*

Webhook + polling: belt and braces

The webhook is fast but fallible; polling is slow but exhaustive. Combined, they guarantee no paid order stays orphaned. The rate of missed webhooks without retry hovers around 2 % — enough to wreck trust if nothing catches them.

The rule: the webhook endpoint acknowledges immediately (200 OK under 200 ms), then pushes the event into a queue. Heavy processing — stock update, email, invoice — runs afterwards, safe from timeouts.

Mini case study

Awa, who runs a cosmetics shop in Dakar, collects 900 orders/month via Wave at 18,000 FCFA average. With a webhook alone, 4 % stay "pending", i.e. 36 stuck orders for 648,000 FCFA of murky revenue each month — unhappy customers and manual refunds. She adds an idempotency key and polling every 10 minutes. Stuck orders drop below 0.3 %: fewer than 3 orders/month to handle by hand. Cost: half a day of development, paid back within the first week.

FAQ

Why do some orders stay "pending"? Because the confirmation webhook got lost (timeout, redeploy) or was never replayed. About 2 % of webhooks are lost without a retry mechanism, and without polling they are never recovered.

What is an idempotency key? It is a unique identifier per event ensuring the same payment is processed only once, even if the webhook arrives twice. Without it, you risk duplicated orders and wrong stock decrements.

Do I need polling if I already have webhooks? Yes: webhooks alone cap around 98 % reliability. Reconciliation polling every 5-15 minutes catches the missing 2 % and brings reliability close to 100 %.

Why reply in under 200 ms? Because if your endpoint takes too long, the provider treats the call as failed and stops resending it. Acknowledge immediately, then process the event asynchronously via a queue.

How do you verify a webhook is authentic? Recompute the HMAC signature with your secret key and compare it to the one in the header. If they differ, reject the event: it is a fake-payment injection attempt.

Let's talk about your project. We make your Wave, Paystack and Orange Money webhooks reliable with idempotency, retry and reconciliation polling. WhatsApp +221 77 596 93 33.