The verdict in three sentences
Without a reliable webhook, 3 to 8 % of Paystack payment confirmations are lost in 2026: the customer paid, but the order stays stuck as pending. The solution rests on three pillars: HMAC signature verification, a retry queue, and idempotency so the same event is never processed twice. The Paystack webhook arrives in under 5 seconds, versus slow, costly and imprecise API polling.
Why confirmations get lost
A webhook is a simple HTTP call from Paystack to your server. If it fails (timeout, deploy, 500 error) and you handle no retry, the order is never confirmed. Without idempotency, a retry can also validate it twice.
| Failure cause | Relative frequency | Fix | Implementation time |
|---|---|---|---|
| Server down during push | High | Retry + queue | 0.5 day |
| Event processed twice | Medium | Idempotency key in DB | 0.5 day |
| Signature not verified (spoof) | Critical | HMAC verification | 0.5 day |
| Heavy-processing timeout | Medium | Reply 200 fast, process async | 0.5 day |
| Validating on browser page | High | Source of truth = webhook | 0.5 day |
Webhook vs polling: the right call
| Criterion | Paystack webhook | API polling |
|---|---|---|
| Confirmation delay | < 5 s | 30 s to several min |
| Request cost | Low (push) | High (repeated calls) |
| Server load | Low | High |
| Reliability | High with retry | Medium |
| Complexity | Signature + idempotency | Simple but heavy |
Polling stays useful as a safety net (nightly reconciliation), but the webhook must be the primary path.
The recommended architecture
- Receive the event, verify the HMAC signature immediately.
- Reply 200 OK in under 2 seconds, then process asynchronously via a queue.
- Use an idempotency key (reference/transaction id): if already processed, skip.
- Mark the order paid, trigger email/SMS and fulfillment.
- Run a daily reconciliation by polling to catch any missed events.
Mini case study
Emeka runs an online store in Lagos with 1,000 orders/month. Without a reliable webhook he lost 5 % of confirmations, i.e. 50 orders stuck for manual handling. At an average basket of 6,000 NGN, that meant 300,000 NGN in delayed sales and an overwhelmed support desk. After deploying an HMAC webhook + retry queue (2 dev-days), his loss rate fell below 0.3 %, i.e. fewer than 3 orders to reconcile — automatically.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Why not confirm the order on the return page?
Because the customer can close the tab before the redirect. The source of truth must be the server webhook, which arrives even if the browser is closed.
What is idempotency concretely?
It guarantees that the same event, received twice, produces a single effect. You store the transaction reference and ignore duplicates.
What is the HMAC signature for?
To prove the call really comes from Paystack and was not forged. Without it, an attacker could fake a successful payment. It is a critical control.
How fast is a Paystack webhook?
Generally under 5 seconds after payment. If your server is unavailable, a retry mechanism resends the event.
Should I still poll?
Yes, as backup: a daily reconciliation catches the rare lost events and secures your accounting.
Let's talk about your project. We make your Paystack webhooks reliable: HMAC, retry, idempotency. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
