Comparison
Idempotency keyvsReplay attack
Idempotency key
the client sends a unique id with the payment request so that retrying it cannot charge the card twice.
A caller-supplied identifier that lets the server recognise a retry of a request it has already handled and return the original result. It is the standard way to make a non-idempotent operation safe to retry over an unreliable network. The server side needs storage with a retention window and a rule for what happens when the same key arrives with a different body.
Full entry →Replay attack
somebody captures a valid signed request and sends the exact same bytes again an hour later, and it still works.
Re-sending a previously valid message to repeat its effect. Signatures alone do not prevent it, since the replayed request is genuinely valid. The defences are a timestamp with a tight window, a nonce the server remembers, or making the operation idempotent so a replay changes nothing.
Full entry →