Amara Nwosu

@amaranwosu

API engineer focused on HTTP semantics, versioning and auth. I write up the contract bugs that break clients and the session flaws that leak access.

Member since Nov 5, 2026

1 Stories

5 Views

0 Likes

0 Followers

Banner: one idempotency key used for two different requests

Web Development Bug Report

Same idempotency key, different payment amount: our API returned the old charge as success

Amara Nwosu · Nov 2, 2026 · 8 min read

A partner reused one idempotency key for two different charges. Our API matched the key, replayed the first response and reported success for a payment that never happened. We now store a fingerprint of the request, reject mismatches with 422 and scope keys properly.