Idempotency

A dropped connection or a double tap can send an order twice. Send an Idempotency-Key header with every POST, and Cashiar places it once:

curl https://api.cashiar.app/v1/storefront/orders \
  -H "Authorization: Bearer pk_live_your_key" \
  -H "Idempotency-Key: 4f9c1b2e-7d3a-4c5f-9e1a-2b3c4d5e6f70" \
  -H "Content-Type: application/json" \
  -d '{ … }'

• The same key again within 24 hours answers with the first response, whatever the body says. Nothing is placed twice.
• While the first request is still running, a retry gets 409 Conflict. Wait a moment and retry.
• A request that failed (any error) frees its key: retry with the same key.

The key is any string of 8 to 100 letters, digits, - or _. Use a new one for each order: a UUID made when the customer reaches checkout is ideal.

const idempotencyKey = crypto.randomUUID(); // once per checkout