SShortSingh.
Back to feed

How Idempotency Keys Stop Payment Apps From Charging Users Twice

0
·2 views

When a payment app freezes after a transaction, users or the app itself often retry the request — but if the original payment already succeeded and only the response was lost, a retry can result in a duplicate charge. Idempotency is the principle that performing the same operation multiple times should produce the same outcome as doing it once. To implement this in payment systems, clients generate a unique idempotency key and attach it to each payment request via an HTTP header. The server stores the result linked to that key, so if the same key arrives again, it returns the cached outcome instead of processing a new payment. This mechanism allows safe retries while distinguishing genuine repeat transactions — which carry a different key — from accidental duplicates.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

A developer built a tool to let freelancers report bad clients without exposure

Freelancer Arun is owed ₹1,20,000 by a design agency since January, but fears publicly naming the client will cost him future work — a dilemma shared silently by three others in the same Discord server. A developer built an agent over a hackathon weekend to let multiple claimants coordinate against a defaulting client without ever revealing their identities to each other or the accused. The tool posts anonymised matter cards on Discord showing only a vague amount band, a time range, and a headcount — never the agency's name. Victims identify the relevant matter by guessing the client and then proving it by naming them independently via email, serving as a self-selecting admission test. The system is deliberately designed so no stored data links a Discord identity to a claimant, eliminating the central leak risk that undermines most whistleblower-style platforms.

0
ProgrammingDEV Community ·

Developer Builds Layered X Post Automation Using OpenAI Codex and xurl CLI

A developer has published a detailed guide on building a scheduled X (formerly Twitter) publishing workflow using OpenAI's Codex and xurl, the official X API command-line client. The system is structured into four layers: an X developer app with read-write authentication, xurl for credential storage and API communication, a Codex skill that verifies account identity before every post, and a scheduled Codex task that researches, drafts, and publishes content. The architecture deliberately separates editorial decision-making from the publishing command, preventing the AI from freely choosing accounts or improvising posts. The guide emphasizes that a well-defined editorial policy — specifying what the automation may and may not publish — is as critical as the technical setup. The workflow was verified in August 2026, and readers are advised to consult current upstream documentation before deploying it in production.

0
ProgrammingDEV Community ·

Tutorial: How to Stress-Test a Prisma API Endpoint by Breaking It Five Ways

A developer tutorial published on DEV Community walks through building a single guarded Prisma API endpoint using prisma-guard 1.33.0, Prisma 6.19.3, and Zod 4.4.3. The guide uses a small multi-tenant data model with Nursery and Plant tables to demonstrate how a generated Express route can enforce an API contract without repetitive handler code. The tutorial then deliberately introduces five distinct breakages targeting shape construction, request validation, Prisma argument generation, and runtime projection. Each failure is designed to show that an HTTP status code alone cannot pinpoint which layer of the stack misbehaved. The stated goal is to give developers a reproducible test they can run during dependency upgrades rather than a one-time rule derived from a single successful response.

0
ProgrammingDEV Community ·

Dev builds abuse-resistant referral system by rewarding listings, not signups

A developer building Adsyte, a free directory for indie projects, has shared the fraud-resistant referral system they recently shipped for the platform. Instead of awarding tokens when a referred user signs up, the system only pays out when the recruit publishes their first listing, making abuse significantly harder. Additional safeguards include duplicate-URL detection, hCaptcha verification, a Redis-based mechanism to prevent double payouts, and a daily reward cap per referrer. Referral codes are generated as HMACs of user IDs rather than stored as random tokens, reducing the risk of leaks or unnecessary data overhead. The developer describes the core principle as 'pay for the outcome, not the action,' arguing this approach eliminates the need for bolt-on fraud detection altogether.