How to prevent duplicate charges with Stripe

1const express = require('express');
2const crypto = require('crypto');
3const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
4
5const app = express();
6app.use(express.json());
7
8// Generate deterministic idempotency key
9function getIdempotencyKey(prefix, ...parts) {
10  const hash = crypto
11    .createHash('sha256')
12    .update(parts.join('_'))
13    .digest('hex')
14    .substring(0, 32);
15  return `${prefix}_${hash}`;
16}
17
18// Create PaymentIntent with idempotency
19app.post('/create-payment', async (req, res) => {
20  const { orderId, amount } = req.body;
21
22  if (!orderId || !amount) {
23    return res.status(400).json({ error: 'orderId and amount required' });
24  }
25
26  try {
27    const paymentIntent = await stripe.paymentIntents.create(
28      {
29        amount,
30        currency: 'usd',
31        automatic_payment_methods: { enabled: true },
32        metadata: { order_id: orderId },
33      },
34      {
35        idempotencyKey: getIdempotencyKey('pi', orderId),
36      }
37    );
38
39    res.json({ clientSecret: paymentIntent.client_secret });
40  } catch (err) {
41    if (err.type === 'StripeIdempotencyError') {
42      // Idempotency key reused with different parameters
43      return res.status(409).json({
44        error: 'Duplicate request with different parameters',
45      });
46    }
47    res.status(500).json({ error: err.message });
48  }
49});
50
51// Checkout with idempotency
52app.post('/create-checkout', async (req, res) => {
53  const { orderId } = req.body;
54
55  try {
56    const session = await stripe.checkout.sessions.create(
57      {
58        mode: 'payment',
59        line_items: [{
60          price_data: {
61            currency: 'usd',
62            product_data: { name: 'Widget' },
63            unit_amount: 2000,
64          },
65          quantity: 1,
66        }],
67        metadata: { order_id: orderId },
68        success_url: `${req.headers.origin}/success`,
69        cancel_url: `${req.headers.origin}/cancel`,
70      },
71      { idempotencyKey: getIdempotencyKey('cs', orderId) }
72    );
73
74    res.json({ url: session.url });
75  } catch (err) {
76    res.status(500).json({ error: err.message });
77  }
78});
79
80app.listen(4000, () => console.log('Server on port 4000'));