Urgent.News

What's breaking now, across thousands of outlets.

Tech

Idempotency Keys for Python Payment APIs

A user double-taps Pay. The network retries. Your API creates two orders for one charge. POST is not idempotent. If you handle payments without an idempotency strategy, you will eventually ship a bug that finance notices before engineering does. I've debugged checkout flows in production — post-payment 500s, guest checkout edge cases, gateway parity. Here are the patterns I use for idempotent…

In the realm of Python payment APIs, ensuring idempotency is crucial to prevent duplicate charges. A user initiates a POST request to create an order with payment details. However, if the network experiences a delay, the same request may be retried, resulting in multiple orders being created for a single charge. This can lead to financial discrepancies.

To address this issue, an idempotency key can be employed. The client generates a unique key for each user action and includes it in every retry request. The server then processes the first request with the key, stores the response, and returns the stored response for any subsequent duplicate requests, without initiating a new charge.

This approach is popular among payment gateways like Stripe. To implement idempotency in a Python application using the FastAPI framework, a request hash is generated from the request body to ensure that the key is unique for each distinct request. The server checks for an existing idempotency key in its database before processing the request.

If the key is already present and the request body matches the stored hash, the server returns the previously stored response. If not, it creates a new entry in the database with the current request details and proceeds with the payment process. By implementing this idempotency strategy, developers can avoid the pitfalls of duplicate charges and maintain a smooth checkout experience for users.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

REST vs SOAP vs GraphQL vs gRPC — Interview Notes for Backend Engineers

I have shipped REST APIs for four years (Flask, AWS Lambda + API Gateway, FastAPI). This is the reference I use in design reviews and phone screens — focused on when to pick each style, not memorising…

  • REST APIs use resources (nouns) and HTTP methods (verbs) with JSON format
  • REST is common for public or mobile APIs due to browser-friendliness and caching
  • gRPC is suitable for internal, high-performance service-to-service communication

Your Compute-Usage Receipt Can Be Cryptographically Signed and Still Be Forged. Here's the One Field That Actually Prevents It, From the Command Line.

Co-authored by Rudrendu Paul and Sourav Nandy . Repo: github.com/RudrenduPaul/ComputeLedger , Apache-2.0. npm install -g computeledger-cli (Node.js 18+) or pip install computeledger-cli (Python…

  • Cryptographic signatures alone cannot guarantee receipt authenticity
  • Public key should be included in signed payload, not separately
  • Hashing entire payload with public key prevents forgery

More from Saturday 29 August →