Idempotency

Paid requests can fail or retry. AllowKit prevents duplicate payments — both for x402 flows and today’s REST API — by tracking:

• payment requirement hash
• resource URL
• method
• amount
• recipient
• allowance ID
• request timestamp
• payment identifier

Rule

Same payment requirement + same allowance + same resource = do not pay twice.

The REST API implements this today via the Idempotency-Key header — see REST API. Reusing the same key with the same payload returns the original result; reusing it with a different payload returns idempotency_conflict.