Idempotency Is Not Optional in Payment Systems

D
Dick Edidiong Bassey
·

A user clicks "Pay." Your server charges the card. The network drops the response. The user sees a timeout. They click "Pay" again.

Without idempotency: the card is charged twice. With idempotency: the second request carries the same idempotency key, your server recognises it, returns the cached success response, and the duplicate charge never happens.

Implementation: accept a client-generated idempotency key header with every state-changing request. Store the key and response in Redis for 24 hours. On receiving a request, check first. If the key exists, return the stored response.

Every payment endpoint I have built implements this. It is not a feature. It is a correctness requirement.

— Dick Bassey | DevDick | 2021