Skip to main content
NorthFond pauses a checkout when it cannot safely determine whether another provider request should be sent or when the payment crosses a configured manual-review threshold. The payment enters review_required and no automatic retry is performed.

​
Safe decision flow

1

Review required

The business receives an in-dashboard notification and, when subscribed, a payment_intent.review_required webhook.
2

Operator decision

An authorized NorthFond administrator inspects the provider reference, failure context, amount, customer, and audit trail.
3

Approve or reject

Approval changes the checkout to approved. Rejection changes it to failed. Every decision requires a reason and is written to the audit log.
4

Customer continuation

After approval, the customer returns to the original checkout and selects Continue with M-Pesa. Only this customer action creates a fresh quote and payment prompt.

​
Guarantees

  • Approval itself never sends an STK prompt.
  • Review decisions are atomic and cannot be applied twice.
  • Resume attempts are rate limited.
  • A quote is consumed once.
  • Treasury settlement is idempotent.
  • Reviews have an expiry time and fail closed after expiry.

​
Review events

Reviews approaching expiry appear in operator health metrics and produce a single merchant reminder. Never build an automated provider retry around review_required.