[stephenr]

I've used the same basic concept for accepting payment-received notifications (from a http redirect based payment gateway):

Read the transaction ID from the request body, and store it (with a date/time) in a table. A periodic process later checks them, and uses the payment service's API to validate the payment is valid and take appropriate action.