reliability
Idempotency
Make POST and other "non-idempotent" operations safe to retry by accepting an idempotency key from the client.
Networks are unreliable, so clients retry — and that is exactly where duplicate-operation bugs are born. A client sends a POST /payments, the server processes it and charges the card, but the response is lost to a timeout; the client, seeing no answer, retries, and the customer is charged twice. Idempotency is the property that makes a repeated request have the same effect as a single one, turning unsafe retries into safe ones.
A receipt number on a coupon — "if you already redeemed this code, here's the original prize back; don't hand out another."
Key Concepts
1
Some HTTP methods are idempotent by definition: GET, PUT, and DELETE can be repeated without additional effect, because they read, replace, or remove a specific resource. POST is not, because each call is meant to create something new. The standard remedy is an idempotency key: the client generates a unique key (a UUID) for the logical operation and sends it in a header like Idempotency-Key. The server records the key together with the result of the first request; if a request arrives with a key it has already seen, the server skips re-executing the operation and returns the stored result instead. This collapses any number of retries of the same logical action into a single effect, which is why payment APIs like Stripe build it in.
GETPUTDELETEPOSTIdempotency-Key
2
The implementation details interviewers want are storing the key with its response and an expiry, handling the race where two requests with the same key arrive concurrently (a unique constraint or lock so only one proceeds), and scoping the key correctly so it identifies one logical operation and not, say, an entire user. The conceptual point to land is the distinction between safe methods (no side effects at all) and idempotent ones (side effects that don't compound on repetition) — and that idempotency keys are how you extend the latter guarantee to operations that lack it natively.