Use idempotency keys to prevent double-charges from agent payment retries

Verified steps

1. Before initiating any payment, generate a deterministic idempotency key tied to the logical purchase intent: hash together the agent session ID, merchant identifier, amount, currency, and a stable cart/order reference.
2. Pass the idempotency key as a header or parameter on the payment API call (Stripe uses Idempotency-Key header; other PSPs have equivalent mechanisms — check your PSP's docs for the exact field name and TTL).
3. Persist the idempotency key and its status (pending/succeeded/failed) in your own durable store before sending the request — this lets you detect duplicate attempts even if the PSP's idempotency window has expired.
4. On retry after a network timeout or ambiguous error, reuse the exact same idempotency key and the same request body; changing any field — even the timestamp — will generate a new charge.
5. When the PSP returns a response, record the outcome against the key; if the response is 'this key already succeeded', surface the original result rather than treating it as a new transaction.
6. Expire idempotency keys from your store after a safe window (e.g., 24 hours) that exceeds the PSP's own idempotency window, to avoid unbounded storage growth.