A caller's idempotencyKey is arbitrary; Adyen's header takes at most 64
characters. A SHA-256 hex digest is exactly 64 and deterministic, so the same
caller key on the same endpoint always derives the same header value and a
replay dedupes at Adyen.
The request path is part of the digest because Adyen stores idempotency keys
at company account level, not per endpoint: a key already consumed by
/payments would make Adyen replay that stored response for the very next
call, whatever endpoint it targets. One caller key legitimately drives two
endpoints — /payments then /payments/details when a 3-D Secure challenge
comes back, or a capture and then a refund — and without the path those calls
collide: the payment would never leave requires_action, and the refund would
answer with the capture's acknowledgement.
A caller's
idempotencyKeyis arbitrary; Adyen's header takes at most 64 characters. A SHA-256 hex digest is exactly 64 and deterministic, so the same caller key on the same endpoint always derives the same header value and a replay dedupes at Adyen.The request path is part of the digest because Adyen stores idempotency keys at company account level, not per endpoint: a key already consumed by
/paymentswould make Adyen replay that stored response for the very next call, whatever endpoint it targets. One caller key legitimately drives two endpoints —/paymentsthen/payments/detailswhen a 3-D Secure challenge comes back, or a capture and then a refund — and without the path those calls collide: the payment would never leaverequires_action, and the refund would answer with the capture's acknowledgement.