What is Idempotency key?

A unique label for one action, so if it is sent twice it still only happens once.

Where Idempotency key goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 5 minutes · Pro
The double order
A customer on slow hotel wifi taps Pay twice. They are charged twice and get two orders.
How do I stop duplicate orders from double clicks?
Give each purchase intent an idempotency key and store it with a unique constraint in the database. When the same key arrives again, return the first result instead of creating a second order. Disabling the button helps, but retries, refreshes and second tabs still send duplicates.
Read the fix
Money and secrets · 5 minutes · Pro
The webhook that arrived twice
A customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.
Why did my Stripe webhook run twice?
Stripe delivers webhooks at least once and retries when your endpoint is slow or fails, so the same event id can arrive twice. Record each processed event id in a table with a unique key and skip repeats, and always verify the signature against the raw request body.
Read the fix
Launch day · 4 minutes · Pro
The reminder that never came
Your app promises 'We'll remind you in 24 hours'. Nobody has ever received the reminder.
Why doesn't setTimeout work in my serverless API?
Serverless functions run for one request and stop shortly after responding, so timers scheduled inside them never fire. Store future work as data with a due time, and process it with a scheduled job (cron) or a queue that retries failures. Check your plan's cron frequency limits.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

All 62 terms in the glossary

Where Idempotency key goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 5 minutes · Pro

The double order

A customer on slow hotel wifi taps Pay twice. They are charged twice and get two orders.

How do I stop duplicate orders from double clicks?

Give each purchase intent an idempotency key and store it with a unique constraint in the database. When the same key arrives again, return the first result instead of creating a second order. Disabling the button helps, but retries, refreshes and second tabs still send duplicates.

Read the fix

Money and secrets · 5 minutes · Pro

The webhook that arrived twice

A customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.

Why did my Stripe webhook run twice?

Stripe delivers webhooks at least once and retries when your endpoint is slow or fails, so the same event id can arrive twice. Record each processed event id in a table with a unique key and skip repeats, and always verify the signature against the raw request body.

Read the fix

Launch day · 4 minutes · Pro

The reminder that never came

Your app promises 'We'll remind you in 24 hours'. Nobody has ever received the reminder.

Why doesn't setTimeout work in my serverless API?

Serverless functions run for one request and stop shortly after responding, so timers scheduled inside them never fire. Store future work as data with a due time, and process it with a scheduled job (cron) or a queue that retries failures. Check your plan's cron frequency limits.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.