How do you handle idempotency for fintech APIs?

Idempotency is enforced at the application layer through dedicated middleware that requires an Idempotency-Key header on all state changing requests (POST, PUT, PATCH). The key is stored with the request fingerprint (method, path, body hash, user) and the response. Subsequent requests with the same key return the cached response without re executing the operation. Idempotency records have a configurable retention window (24 to 72 hours typical) after which the key can be reused. Combined with database transactions, queue job deduplication, and webhook replay protection, this gives the 'exactly once' processing guarantees fintech operations actually need. The pattern aligns with how Stripe, Adyen, and similar payment providers expect API clients to behave.