Network errors are inevitable. Without idempotency, a client that retries a failed payment request might charge the user twice. Idempotency keys fix this at the API layer — and Claude can wire them up across your endpoints.
Add idempotency key support to our POST /orders and POST /payments endpoints. Clients
should send an Idempotency-Key header. Cache the response for 24 hours keyed by that
value so retries return the identical response without re-processing the request.
Use Redis for the cache.
Claude will generate the middleware that checks for an existing cached response and returns it immediately on duplicate requests, or executes and stores the response on first use. It handles the full response — status code, headers, and body.
Harden it further:
Add validation that rejects requests where the same Idempotency-Key is used with
a different request body — return a 422 with an error message explaining the conflict.
For extra reliability, ask Claude to add a unique constraint at the database level as a second guard against race conditions on concurrent duplicate requests.
Stripe, Braintree, and most payment processors implement this pattern — it's what makes retrying safe.
Idempotency keys are what separate a toy API from one you'd trust with real money.
Log in to leave a comment.
The /security-review command scans your uncommitted changes for injection vectors, auth gaps, hardcoded secrets, and other common vulnerabilities.
The SessionStart hook fires when any session begins or resumes, making it ideal for loading environment variables and running one-time setup scripts.
Ask Claude to write property-based tests for your functions using fast-check — it identifies the mathematical invariants in your code and generates tests that cover inputs you'd never enumerate by hand.