Every API that sits behind an unreliable network eventually faces the same problem: a client sends a request, the connection drops before the response arrives, and the client has no idea whether the operation happened. Did the payment go through? Did the order get created twice? The client's only safe move is to retry — which means your server needs a story for what happens when the same "create this thing" request arrives more than once.
That story is idempotency keys, and getting the details right is more subtle than it first looks.
The core idea
The client generates a unique token — typically a UUID — once per logical operation, and attaches it to every retry of that operation:
POST /orders
