The verdict in three sentences
An order must never be marked paid on the client redirect: only a verified, idempotent webhook is truth. The real choice is between webhook + reconciliation poll and redirect trust, and missed webhooks (2-5%) cause double-shipped or lost orders. An idempotency key, signature verification and a fallback poll close these gaps.
Why the redirect lies
The browser redirect can fail (network drop, closed tab, back button) while the payment did go through — or the reverse. The signed, replayed server-to-server webhook is the only reliable source.
| Mechanism | Client redirect | Verified webhook |
|---|---|---|
| Reliability | Low | High |
| User-manipulable | Yes | No (signature) |
| Survives closed tab | No | Yes |
| Double credit possible | Yes | No (idempotency) |
| Fraud risk | ~1% | near 0% |
Numbers of a robust integration
A reliable webhook combines retry, idempotency, signature verification and a fallback poll to catch missed cases.
| Element | 2026 target value |
|---|---|
| Webhook delivery failure rate | 2 to 5% |
| Retry strategy | exponential backoff |
| Fallback poll | every 5 min |
| Gap caught by poll | ~3% |
| Idempotency key | mandatory (anti double-credit) |
| IPN signature verification | mandatory (anti spoofing) |
In M-Pesa, the C2B confirmation and validation URLs must verify the transaction server-side before crediting the order.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Aminata runs an online store handling 2,000 orders per month. At a 3% webhook failure rate, about 60 orders/month risk never being confirmed automatically. With a fallback poll every 5 minutes, she catches ~3% of these cases and avoids wrongly shipping or wrongly refunding. On a 20,000 FCFA average basket, securing even 20 ambiguous orders protects ~400,000 FCFA of flow per month.
FAQ
Why not trust the redirect? Because it can fail while the payment succeeded, or be manipulated. A store shipping on an unverified redirect faces about 1% fraud loss. Only the verified webhook is truth.
What is an idempotency key for? It prevents crediting the same order twice when a webhook is replayed (providers resend events on failure). Without it, a legitimate retry can trigger a double shipment.
How do I block a fake webhook? Through IPN signature verification: each event is signed by the provider and rejected if the signature doesn't match. That's the protection against spoofed IPNs sent by an attacker.
Is the reconciliation poll really needed? Yes. With 2-5% missed webhooks, a fallback poll every 5 minutes catches the ~3% of orders left pending, avoiding lost or double-processed orders.
Let's talk about your project. We build your idempotent, signed, reconciled payment webhooks, tested before going live. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
