What you need to know
A network timeout does not tell a client whether the server completed a payment or created an order. Retrying without protection can duplicate an action that should happen once.
How to apply it
Accept a unique idempotency key for a bounded time window, store the result with the operation, and return the same result for the same key. Scope keys to the authenticated user and endpoint.
Common mistake to avoid
Do not trust a client key as proof of authorization. Verify permissions and validate the request before reusing a stored result.