Idempotent retries in payment systems

Networks fail in the worst possible place: after the server did the work but before the client heard back. The client retries, and without protection the customer pays twice.

The idempotency key

The client generates a unique key per logical operation and sends it with every attempt. The server stores key → result and replays the stored result for repeats.

Step	What the server does
First request	Lock key, process, store result
Retry while processing	Return `409 in progress`
Retry after success	Return the stored result

Backoff strategy

Retry with exponential backoff and jitter, otherwise every client retries at the same instant and you DDoS yourself.

delay := base * time.Duration(1<<attempt)
delay = delay/2 + time.Duration(rand.Int63n(int64(delay/2)))