Secret keys (Bearer allow-list)
sk_test_* / sk_live_* keys. Anything else gets the documented 401 {"status":false,"message":"Invalid key"}. The prefix decides the domain stamped on objects; the key also signs webhooks (HMAC-SHA512 of the raw body in x-paystack-signature).
Dashboard settings
Webhook URL — target of charge.success / refund.* events (200-only ack, 3-min×4 retry leg; hourly tail not emulated). Callback URL — default payer redirect, overridden per transaction by initialize callback_url.
Transactions
Outcomes resolve immediately; the webhook delay is chosen on the checkout page. Failed/abandoned charges fire NO webhook — merchants learn of them via verify only.
Refunds
pending → processing → processed | failed, each step firing its refund.* event (amount is a string in pending/processing/processed, a number in failed — the doc’s own quirk). Processing the last kobo flips the transaction to reversed.