Credentials and integrations
Prevent replay and duplicate work
Use expirations, nonces, idempotency keys, and stored operation results where repeated requests could charge, send, or mutate twice.
8 minute lesson
Networks retry. Attackers replay. A sensitive operation needs a clear answer to “what if this exact request arrives again?”
Use idempotency keys tied to the caller and operation, store the result for a bounded period, and reject conflicting reuse. For signed requests, include a timestamp or nonce and enforce a replay window. Design database changes atomically.
A client times out after payment succeeds and retries the same request. Returning the stored result prevents a second charge, while reusing the key with a different amount must fail.
Store the key and result atomically with the operation. Otherwise two workers can both see an unused key and perform the same side effect before either stores evidence.
Send two concurrent payment requests with the same idempotency key and body. Prove one charge exists, both callers receive the same result, and conflicting key reuse is rejected.
Lesson completed