The verdict in three sentences
The webhook is the only reliable signal that a Paystack or Flutterwave payment succeeded — never the browser callback URL, which a customer can close before it loads. In 2026 a serious integration rests on three pillars: signature verification, idempotency and daily reconciliation. Without idempotency, you see 2% to 4% duplicates from automatic retries.
Trusting the webhook vs status polling
The two mechanisms are complementary: the webhook is your primary source, polling your safety net when it fails to arrive (server down, unstable network).
| Aspect | Webhook | Status polling |
|---|---|---|
| Latency | Near real-time | 15 s to 3 min |
| Server load | Low | Higher |
| Reliability if server down | Retried by provider | Depends on your cron |
| Recommended role | Primary source | Fallback / reconciliation |
| Duplicate risk | Yes (retries) | Yes (if not deduped) |
The right architecture: webhook primary, polling every 15 seconds for 3 minutes as fallback, then a daily reconciliation log to catch the rest.
Retry, idempotency and reconciliation by provider (2026)
2026 orders of magnitude per provider docs. Always confirm exact values in your dashboard.
| Provider | Webhook retries | Signature window | Idempotency key | Reconciliation |
|---|---|---|---|---|
| Paystack | 5x (backoff) | 5 min | event id | Dashboard + API |
| Flutterwave | 3x | verif-hash | tx_ref unique | Transactions API |
| M-Pesa (Daraja) | callback + query | shortcode auth | CheckoutRequestID | Query API |
| Stripe | up to 3 days | 5 min tolerance | event id | Dashboard |
| DPO | polling-based | verify token | company ref | Verify API |
The rule: every event carries a unique id; your database stores processed ids and ignores duplicates before any credit.
The four rules of a robust webhook
- Verify the signature inside the 5-minute window; reject beyond it (replay protection).
- Be idempotent: one unique key per transaction, a duplicate is ignored. This eliminates the 2-4% duplicates from retries.
- Respond fast: return HTTP 200 immediately, process in the background (retry queue). Heavy synchronous work triggers needless retries.
- Reconcile daily: compare local transactions against the provider API to recover lost webhooks.
Mini case study
Kwabena, who runs a restaurant in Accra, collects 1,200 orders/month via Paystack, average basket GHS 90.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
- Without idempotency, 3% duplicates = 36 orders processed twice. If 10 trigger a refund/goodwill gesture at GHS 90: GHS 900/month lost plus support time.
- With an idempotency key: 0 duplicates, and the reconciliation log recovers the ~1% missing webhooks (12 orders) otherwise "paid but unfulfilled."
Implementation cost of idempotency: a few hours of dev, recouped in the first month.
FAQ
Can I rely only on the browser callback URL?
No, never. The customer can close the tab before it loads. Only the signed webhook (backed by polling) reliably confirms a payment.
How many times does Paystack retry a webhook?
The order of magnitude is 5 times with backoff. Your endpoint must be idempotent so it doesn't credit multiple times.
What is an idempotency key?
A unique id per transaction. If the same event arrives twice, you detect the already-processed key and ignore the duplicate — essential given the 2-4% retries.
What is the signature verification window?
About 5 minutes on Paystack and Stripe. Beyond that, reject the request to prevent replay attacks.
What is daily reconciliation for?
To recover webhooks never received (server briefly down). A cron compares your transactions to the provider API and fixes discrepancies.
Let's talk about your project. We build robust, idempotent, reconciled webhooks for Paystack, Flutterwave and Wave. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.