Aglet

Investigate API idempotency key reuse

Investigation should explain whether two calls represent one operation or two. Build paired operations with similar payloads and controlled retries, then trace keys and results across client and storage. Keep low-entropy keys, missing persistence, concurrent races, and remote expiry as competing explanations.

Build a useful investigation brief

  1. Build operation pairs

    Create two logical operations with similar but distinct intent, two retries of one operation, and a timeout after dispatch. Assign expected key relationships before execution. Use synthetic resources and preserve the difference between payload similarity and operation identity.

  2. Trace key ownership

    Capture key generation input, concurrency context, local persistence, outbound request, response identifier, and retry decision. Compare key values and payload fingerprints without logging secrets. Inspect whether a process restart or race changed the key attached to the original operation.

  3. Test expiry and races

    Vary one key source, process timing, payload, operation, or retry interval at a time. Compare a result replay with a new mutation. If remote key retention is undocumented, record that limitation and avoid treating a late response as evidence of collision or safety.

What to carry forward

The investigation is ready when one-operation retries and distinct operations show their key, result, and local association paths. Deliver a narrow key-scope or storage change and a reconciliation need. Leave external key lifetime explicit where it cannot be observed.

Technical background: Stripe documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow