What is an idempotency key for POST requests?

An idempotency key makes non-idempotent POST requests safe to retry. The client generates a unique key (UUID) and sends it as a header: Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000. The server stores the key and its associated response. If the same key arrives again (due to a network retry), the server returns the stored response instead of processing the request again. This prevents duplicate payments, double-sends, or duplicate resource creation when requests time out and the client cannot tell if the server processed the request. The stored response is typically retained for 24 hours. Stripe's payment API uses idempotency keys extensively — creating a charge is idempotent if you use the same key, preventing customers from being charged twice due to network timeouts.