[celticmusic]

You render a UUID into the browser form and send it along with the submission however you want (post input, http header, etc). Then the server both requires the UUID to be there and passes it along to stripe.

Stripe will not allow an idempotent key to be reused w/i 24 hours.

You can use anything for the idempotent key and Stripe will actually track that along with the charge object so you can use something more meaningful if it's useful for your business.

edit: and if you generate a key that's more meaningful I'd be careful about leaking important/private data.

[leto_ii]

Yeah, but that should only prevent duplicates due to technical errors, but not duplicates because the person actually made a number of distinct purchases my mistake.

Take a look also at edwinwee's answer below.

[celticmusic]

What you just said is 100% incorrect and I strongly recommend you read back over what I wrote and think about it a bit more.