API Design · Junior · Question 68 of 75

A user double-clicks 'Pay', and the client sends `POST /payments` twice. What's the risk and a common fix?

1No risk: HTTP drops duplicate requests
✓Correct answer: Two payments, since POST isn't idempotent; the client sends an Idempotency-Key header so the server processes the key only once
3The second request always fails with 409 automatically

Explanation

Stripe popularized idempotency keys. Disabling the button helps too, but retries after timeouts still need server-side protection.

Further reading

Test yourself

Take the API Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.