Idempotency

Send an Idempotency-Key header on every create request; payment intents, payouts and refunds require it. Keys are kept for 24 hours per business and environment.

• Same key, same body: the first response is replayed with status 200 and Idempotent-Replayed: true. Nothing is created twice.
• Same key, different body: 409 idempotency_conflict.
• Same key while the first request is still running: 409 idempotency_conflict; retry shortly.
• No key on a create: 400 idempotency_key_required.

A timeout is never a failure. Retry with the same key, or read the object, before you assume the payment did not happen.