A technical analysis of MTN's payment API callback behavior, revealing that providerCallbackHost functions as an allow-list restricting where callbacks can be sent, not a delivery destination. The author documents critical design implications: callbacks arrive unsigned and unauthenticated, lack referenceId fields, and may retry after successful receipt, requiring systems to treat timeouts as unknown states requiring reconciliation rather than definitive failures.
When an agent receives a timeout from an API call, it cannot know whether the operation succeeded or failed, only that the response didn't arrive. Retrying without tracking the original operation risks duplicating the action, even with idempotency keys, if the agent frames the retry as a new tool call. The solution requires binding operations to persistent identities that survive retries and recovery, following principles from distributed systems design.