Retries in payment and order APIs are a classic footgun. Your client times out, retries the request, and you've just charged someone twice. The fix is idempotency-key handling, but getting it right is harder than it looks.
The naive approach breaks under load
The obvious solution is Redis SETNX: claim a key before running the handler, release it after. Works fine on the happy path. Breaks in at least three ways:
Two identical requests arrive simultaneously before either has claimed the key. Both get through and execute.
Your handler panics or returns an error. The lock never gets released.
