Every network call ends in success, failure or "we don't know". The third causes duplicate orders, double charges and stuck jobs. How status codes, timeouts, retries with backoff and idempotency keys fit together, with the limits on API Gateway and Lambda.
When a request times out, you do not know whether the server did the work. Retrying might do it twice; not retrying might never do it. Each habit below exists to make that third outcome safe.
HTTP defines GET, PUT and DELETE as idempotent: sending one twice has the same effect as once (RFC 9110). POST is not, and POST is what creates orders, sends messages and charges cards. To make a POST safe to retry, give it an idempotency key.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The client generates a unique key, such as a UUID, per operation (one checkout, not one HTTP attempt) and sends it in a header, conventionally Idempotency-Key.
The server stores the key with the result the first time it does the work.
A retry with the same key gets the stored result instead of doing the work again.
Stripe works this way: every POST accepts an Idempotency-Key of up to 255 characters, retries get the saved response, keys may be pruned after 24 hours, and reusing a key with different parameters is an error. Do the same on your own endpoints that create things, and pass keys through to every provider that accepts them.
Set one on every outbound call; many HTTP clients will wait far longer than your user. In JavaScript, pass AbortSignal.timeout(ms) to fetch. Each layer's timeout should be shorter than the one above it, or the outer layer gives up while the inner one is still working.
Retry only idempotent requests or ones carrying an idempotency key.
Back off exponentially with random jitter, so thousands of clients do not retry in lockstep and flatten a recovering service.
Cap attempts, and retry at one layer only. Three layers of three attempts is 27 calls.
Honour Retry-After on 429 and 503.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Receiving Webhooks Without Losing Money: Signatures, Retries, Duplicates and Order
Payment, auth and email providers tell your app what happened through webhooks. They arrive late, twice, out of order or not at all, and anyone can send a fake one. Using Stripe's documented behaviour as the example, the handler pattern that survives all of it.
Read
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.