Idempotency & Retry Safety

Local review for this concept

Start a focused review session for Idempotency & Retry Safety.

Learning objectives

• Decide when operations need idempotency keys and stored results.
• Handle retries, in-progress operations, and reused keys with different payloads.
• Combine idempotency with database constraints and transactional consistency.
• Verify webhook authenticity using raw request bodies and signatures.
• Recognize replay attacks, duplicate deliveries, and unsafe side effect ordering.
• Design webhook handlers that acknowledge only after durable acceptance.

Common mistakes to avoid

• Creating a second payment, order, or import because a retry arrived later.
• Allowing the same idempotency key to mean different request bodies.
• Forgetting that in-progress requests also need duplicate protection.
• Using browser storage or IP address as the source of server-side dedupe truth.
• Verifying a re-serialized JSON body instead of the raw body bytes.
• Treating a valid signature as proof that the event is fresh or unique.