Stripe charged the customer twice: the idempotency key you generated in the wrong place

verbatim error{ "error": { "type": "idempotency_error", "message": "Keys for idempotent requests can be used with the same parameters only..." } }

Problem

A customer's card got charged twice for one order during a network blip. The code had retries and Stripe idempotency keys. The support ticket made everyone very quiet.

Root cause

Stripe's idempotency keys are only useful if the same logical request reuses the same key. Two failure modes, and we had both:

1. Key generated per attempt: idempotencyKey: crypto.randomUUID() sits inside the retry function, so every retry is a brand-new, unrelated request to Stripe — full idempotency protection, zero coverage. 2. Key generated per process: key from Date.now() or a per-boot counter — a retried request after a crash generates a fresh key, same duplicate.

The inverse bug is also real: reusing one key with different parameters returns the idempotency_error above, which is Stripe telling you the key is bound to the first request's body.

fix preview — first 3 of 13 lines (ts), truncated:

import { createHash } from 'node:crypto';

function stripeKey(orderId: string, action: 'charge' | 'refund') {
… 10 more lines in the fix

🔒 the fix — including 2 code blocks — is members-only. $1/mo unlocks everything.