Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Yes. A screen that looks correct cannot prove that a payment was processed only once. If a request reaches the payment provider but its response is lost, a retry or a second checkout session can create another payment unless the system recognizes both requests as the same operation. For shoppers, check the order and payment records before trying again. For developers, use provider-supported idempotency keys and reconcile uncertain outcomes.

How can one click lead to two payments?

After you click Pay, the browser sends a request to the merchant’s server, which may pass it to a payment provider. The provider can process the request even if the response never makes it back to the browser. Your screen may keep spinning, appear unchanged, or fail to show a confirmation. If you submit again, the second request may be treated as a new payment.

That can happen through another click, an automatic retry, a page refresh, or a separate checkout session. The screen only reflects what the app has learned; it cannot reveal whether an earlier request reached the provider. Adyen documents that separate payment sessions using the same merchant reference can be processed as separate requests with separate PSP references (Adyen’s duplicate-transaction guidance).

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Does a second card entry mean you were charged twice?

Not necessarily. Two entries may represent two completed payments, or one completed payment and a pending authorization that has not settled. Check the merchant’s order and payment history, and compare the transaction details rather than relying on the checkout screen alone. If the status is unclear, contact the merchant with the order number and the transaction details shown by your bank; avoid repeatedly submitting the payment while the first outcome is unknown.

Adyen says a pending duplicate charge may be canceled automatically in about 4–5 working days, depending on how quickly the bank updates it. That is Adyen support guidance for its context, not a timetable that applies to every bank or processor (Adyen Help: duplicate charges). If both entries appear completed or the pending entry does not resolve, ask the merchant to investigate the provider records.

What does an idempotency key do?

An idempotency key is an identifier attached to a payment request so the provider can recognize retries of the same logical operation. Adyen says its API supports retrying a request while performing the action only once (Adyen API idempotency documentation). Stripe likewise stores the first result for a key and returns that result on later uses; if the later request has different parameters, Stripe reports an error rather than treating the key as a different operation (Stripe API reference).

The key must be reused for a retry of the original payment, with the same request parameters. A new key can signal a new operation. A key should identify one logical payment attempt—not be reused for unrelated purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should a payment system handle a timeout?

  1. Persist the attempt. Before or as the payment request is sent, store the application’s payment-attempt identity and its idempotency key, linked to the order.
  2. Keep the same identity on retry. If the response is missing, query the existing attempt where the provider supports status lookup, or retry the same request with its original key and parameters. Do not create a fresh key just because the first response did not arrive.
  3. Reconcile the result. Associate the provider’s outcome with the order and update application state from the provider’s payment record, rather than assuming a timeout means failure.
  4. Process notifications safely. Use provider webhooks where available to learn about asynchronous outcomes. Treat repeated notifications and background retries as repeatable inputs, making state transitions idempotent so the same event does not create another side effect.

Adyen recommends server-to-server webhooks for tracking missing responses. AWS also recommends idempotent handling for retried operations that cause external side effects, such as charging a payment card (AWS Durable Execution idempotency guidance; AWS Well-Architected Framework).

Why aren’t an order number or disabled button enough?

A matching order number

An order number or merchant reference helps connect transactions to an order, but it is not automatically a deduplication mechanism. Adyen explicitly says it does not check merchant-reference uniqueness when processing payment requests. Use the processor’s documented idempotency feature for duplicate suppression; keep the reference for tracing and reconciliation.

A disabled Pay button

Disabling the button can reduce accidental repeat clicks, but it cannot undo a request already sent or resolve a lost response. It is a user-interface safeguard, not a substitute for server-side idempotency and payment-state tracking.

A success screen

A confirmation tells you what the application displayed, not necessarily that every related request was deduplicated. The reliable evidence is the merchant’s order state and the provider’s payment records, reconciled together.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What are the limits of idempotency?

Idempotency only works within the provider’s documented scope and rules; it does not automatically merge separately created payment intents, checkout sessions, or business actions. For example, Adyen documents keys as account-scoped, valid for 7 to 14 days, and not checked across regional endpoints. Its documentation also describes behavior for requests that are still in progress. Check the provider’s current API documentation before designing retries around these boundaries.

“Exactly once” is too broad unless carefully qualified. Distributed systems may retry work, and a request can be received more than once. The practical goal is to make repeated submissions of the same logical operation produce no more than one effective payment within the provider’s supported key scope and your application’s state-handling rules. AWS describes idempotency tokens as a way for services to receive a mutating request one or more times without creating duplicate records or side effects.

What should developers compare across payment APIs?

Before implementing retry behavior, check the provider documentation for these details:

  • Key scope: whether keys apply by account, endpoint, region, or operation.
  • Retention: how long a key remains valid.
  • Concurrent duplicates: what happens if identical requests arrive while the first is still processing.
  • Parameter consistency: whether changed parameters under the same key are rejected.
  • Result recovery: how to retrieve the original outcome after a timeout.
  • Reconciliation options: whether status lookup and webhooks are available.

These differences determine whether a retry is safe in a particular case; do not assume one provider’s behavior applies to another.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.