Where it applies
Send anIdempotency-Key header on every POST /v1/orders. This is the money-moving write where a duplicate matters most.
Idempotency-Key header so you can confirm it was honoured.
The official SDKs attach an
Idempotency-Key automatically on order placement (a fresh UUID per call), and let you pass your own when you want to control it. If you build the request yourself, set the header yourself.How to choose a key
- One key per logical order. Derive it from something stable in your own system, a UUID you persist with the order row, or a natural key like
sell:{scrip_no}:{attempt-group}. The same intent must always produce the same key. - Never reuse a key for a different order. The key identifies this order; a new order needs a new key.
- Keep it opaque and bounded. A UUID is ideal. Do not encode secrets or PII into it.
What it protects against
Pattern: retry loop
429 and transient 5xx for you with backoff, reusing the key you pass, so most integrations never write this loop. It is shown here to make the guarantee explicit: even across process restarts, the same key can never place a second order.
The rule is simple: generate the key once, before the first attempt, and reuse it on every retry of the same order. Generating a new key per attempt defeats the protection.
Related
- Place an order, the endpoint that honours the key.
- Rate limits, why retries happen and how to back off.
- Errors, what to retry and what not to.