Building Reliable Wave/WooCommerce Payment Webhooks in Dakar 2026

The verdict in three sentences

Most paid-but-unvalidated orders don't come from a payment bug but from a non-idempotent webhook: the customer paid, the confirmation arrived twice or not at all, and WooCommerce never marked the order as settled. Without a retry policy, 3 to 6% of Wave webhooks are silently lost. The fix rests on four pillars: HMAC signature, idempotency key, 24h retry and cross-reconciliation via API.

Polling vs webhook: why the signed webhook wins

Many stores start with polling (looping to check status): it's fragile, call-heavy and slow. The signed webhook with retry is the only reliable approach in 2026.

Average Wave confirmation delay is 2 to 8 seconds: a well-built webhook validates the order almost instantly, where polling leaves the customer on an uncertain waiting screen.

The 2026 technical checklist for zero ghost orders

Here are the parameters to respect, drawn from production integrations in Dakar (2026 order of magnitude).

The golden rule: the endpoint must return HTTP 200 in under 5 seconds and process the rest asynchronously. Heavy synchronous work causes a timeout, hence a re-fire, hence a duplicate if idempotency is missing.

Mini case study

Fatou runs an electronics store in Dakar, 600 orders/month, average basket 35,000 FCFA. Before the rebuild her webhook had neither retry nor idempotency: 5% ghost orders, i.e. 30 orders/month stuck as "pending" while the customer had paid. Result: disputes, manual refunds, damaged reputation. After implementing the checklist (HMAC + idempotency + retry + 15-min reconciliation), the rate drops to 0.3%, under 2 orders/month. She recovers ≈ 28 orders × 35,000 = 980,000 FCFA/month of revenue previously lost or wrongly refunded.

FAQ

Why is an order "paid but unvalidated"?

Because the confirmation webhook was lost or processed twice without an idempotency key. Without retry, 3 to 6% of confirmations never arrive and the order stays pending despite payment.

What is an idempotency key concretely?

A unique per-transaction identifier ensuring that the same event processed twice creates only one validation. It's the safeguard against duplicates when a webhook is re-sent after a timeout.

How many retry attempts are needed?

A good 2026 policy is 5 attempts spread over 24h (exponential backoff). This recovers temporary network losses without hammering your endpoint.

Is cross-reconciliation really necessary?

Yes, it's the safety net. A job comparing WooCommerce state and the payment API every 15 minutes catches the rare cases where even retry failed, guaranteeing < 0.5% unreconciled orders.

Must I verify the HMAC signature on every call?

Yes, without exception: it's what stops a third party from sending a fake "paid" webhook to trigger a shipment. An endpoint that doesn't verify the signature is an open door to fraud.

Let's talk about your project. We build your signed, idempotent, reconciled Wave/WooCommerce webhooks to eliminate ghost orders. WhatsApp +221 77 596 93 33.