Same idempotency key, different arguments: refuse the mismatch
The agent paid the invoice once. Then the model regenerated the tool call for a retry, kept the same idempotency key, and changed the memo field by a few words. The server saw the familiar key, returned the original receipt, and the caller moved on. In the ledger it looks like the corrected call went through. It never did. Yesterday I wrote about where an AI agent's idempotency key should come…
When an AI agent issues an idempotency key for a request and the server receives that same key with different arguments, the server must not replay the last stored response. This is known as the "key-only matching bug." The server stores a mapping of key to response, and on subsequent requests, it only checks the key and returns the stored response.
However, this approach fails when the arguments have changed between retries, as the server returns the old receipt for a call that may not have actually occurred. This can lead to silent errors, double charges, and a false sense of success in the system's records. To avoid this issue, the server should hash the request arguments and store the hash along with the response.
On a retry, the server compares the hash of the new request with the stored hash. If the hashes match, the original response is returned, preventing a second side effect and charge. If the hashes differ, the server should refuse the mismatch and signal a conflict to the client, which must then handle the situation appropriately.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
