An idempotency key is a unique value, often a randomly generated identifier, that a client attaches to an API request so that the server can tell whether it has seen the same request before. If a payment request is sent twice with the same key, the server performs the payment once and returns the original result to the second call. The key is the most common way payment APIs achieve idempotency, the underlying property explained in the main entry.
The key is usually sent in an HTTP header named Idempotency-Key, a convention used by many payment providers and described in an IETF draft standard. The server stores each key with the request details and response for a limited period; if the same key arrives with different request content, it normally rejects the call as an error.
Idempotency keys make payment retries safe after timeouts or dropped connections. They prevent duplicates at the moment of sending, whereas matching references in reconciliation finds duplicates afterwards. Similar keys are used to de-duplicate events delivered by webhook notifications.