Skip to main content

Authorize retries are now idempotent

· One min read

Authorize retries are now idempotent​

POST /api/v1/payment-intents/{paymentIntentId}/authorize now accepts an optional data.attributes.idempotencyKey. Send one, and reuse it for every retry of the same authorization — including after a timeout or a lost response.

A matching retry returns the original success response instead of authorizing again. A request that arrives while the first attempt is still in flight returns 409. Reusing the key with different attributes (amount, reference, channel, risk.deviceSessionId, or meta.processor) also returns 409 and is not replayed.

The key is optional for backwards compatibility and is expected to become required. Concurrent retries of an in-flight processor authorize still return 409 (and do not charge twice) even when no key is sent.

A timeout is not proof that authorize failed. Keep the same key until you receive a success or a definitive 402 decline. Do not rotate the key and do not create a new payment intent to recover from an ambiguous failure.

Use a client timeout of at least 60 seconds when a card processor is configured. See Using Payments API and the authorize operation.