The verdict in three sentences
An unverified payment webhook is an open security hole: anyone can fake a confirmation and claim a free order. The 2026 best practice rests on three pillars: HMAC signature verification, idempotency (processing the same event twice without duplicating), and replay protection. Because 0.1 to 2 % of webhooks are lost, always add reconciliation by polling every five minutes.
Signature mechanisms by provider
Every provider signs webhooks differently. Your server must recompute the signature from the raw request body and compare it, in constant time, to the received header.
| Provider | Signature header | Algorithm |
|---|---|---|
| Paystack | x-paystack-signature | HMAC-SHA512 |
| Flutterwave | verif-hash | Shared secret hash |
| M-Pesa | Callback validation | IP whitelist + amount check |
| Wave | Webhook signature | HMAC on payload |
| Orange Money | Server notification | Token + status API check |
| Stripe | Stripe-Signature | HMAC-SHA256 + timestamp |
The three golden rules
Webhook security is more than a signature. These three mechanisms work together.
| Rule | Problem avoided | Implementation |
|---|---|---|
| HMAC verification | Fake webhook | Recompute and compare |
| Idempotency | Double processing | Unique key per event |
| Anti-replay | Replayed request | Timestamp + short window |
| Raw body | Invalid signature | Do not re-serialise JSON |
| Fast response | Provider timeout | Return 200, then process |
| Reconciliation | Lost webhook (0.1-2 %) | Poll status every 5 min |
Mini case study
Fatou runs an online store in Dakar handling 500 orders a month at 20,000 FCFA (10,000,000 FCFA). Without reconciliation she loses 1 % of webhooks, about 5 already-paid orders never marked as such: roughly 100,000 FCFA in customer disputes and wasted time each month. Adding a five-minute polling job recovers those transactions automatically and drives incidents near zero. The cost: half a day of development.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Why never confirm an order on the redirect response alone?
Because the client-side response can be interrupted, replayed or forged. Only a webhook whose HMAC signature is verified server-side truly proves payment.
What is idempotency and why is it critical?
It guarantees that processing the same event twice does not create two orders or two shipments. You implement it with a unique event key stored in your database.
How many webhooks are actually lost?
The order of magnitude is 0.1 to 2 % depending on the provider and network quality. That is why five-minute polling reconciliation is essential.
What is a replay attack and how do I prevent it?
An attacker captures a valid webhook and resends it later. You prevent it by checking the event timestamp and rejecting anything outside a short time window.
Let's talk about your project. We secure your payment webhooks with HMAC, idempotency and automatic reconciliation. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.