Question

Design the backend for handling 3-D Secure / redirect-based payments (cards requiring a bank challenge, plus APMs like iDEAL/SEPA that redirect the user to their bank). The user leaves your site, authenticates at their bank, and returns; the authoritative result also arrives asynchronously via a PSP webhook that may come before, after, or instead of the redirect-back. ~1,500 payment attempts/sec. Describe the payment state model and how you reconcile the redirect-return and the webhook into one correct final status.