How Idempotency Keys Prevent Double Charges Caused by Payment Timeouts

When a payment request succeeds on the server but the response never reaches the client due to a connection drop, the customer may retry and get charged twice. Idempotency keys — unique identifiers generated by the client and sent with each request — allow the server to detect and reject duplicate transactions. A naive database check-then-save approach is still vulnerable to race conditions when simultaneous requests arrive within milliseconds of each other. In Laravel, this can be solved using Cache::lock(), which ensures only one request is processed at a time by blocking concurrent duplicates until the first completes. Stored keys should include the original response and be deleted after a set retention window, such as 24 hours, to avoid unnecessary database bloat.